Hello friends! Today we are going to take another boot2root challenge known as “DC-1: 1”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

• IP Discovery using netdiscover
  
• Network scanning (Nmap)
  
• Surfing HTTPS service port (80)
  
• Finding Drupal CMS
  
• Exploiting Drupalgeddon2 to get a reverse shell
  
• Finding files with SUID bit set
  
• Finding the “find” command with SUID bit set
  
• Getting root shell with “find” command
  
• Getting final flag
  

• IP Discovery using netdiscover
  
• Network scanning (Nmap)
  
• Surfing HTTPS service port (80)
  
• Enumerating password from Source code.
  
• Enumerating robots.txt and finding the zip file
  
• Unzipping zip file
  
• Enumerating password from the binary file
  
• Enumerating the hardcoded command
  
• Editing the hardcoded command
  
• Getting a reverse shell
  
• Enumerating password for the user
  
• Elevate Privileges to get root
  
• Getting Flag
  

• Network scanning (nmap).
  
• Logging in FTP using Anonymous Login.
  
• Using strings to read contents of the .mdb file.
  
• Unzipping Zip file using 7z.
  
• Using readpst to read the contents of the .pst file.
  
• Finding Login Credentials
  
• Logging into Telnet.
  
• Finding the first flag user.txt
  
• Using web delivery module to create PowerShell code.
  
• Getting Meterpreter.
  
• Using exploit suggester of Metasploit.
  
• Getting Root Access.
  
• Changing the Administrator password using net user.
  
• Reading Our Final flag root.txt
  

This is the third article in our empire series, through this we will learn elevated persistence methods. Its trigger method is pretty organised with storage options contained within each module.
In Empire, the elevated persistence modules use trigger method and different storage options are required in different modules.  All of these persistence modules are based on PowerSploit’s persistence. As these are elevated persistence, it requires you to have admin access to work as intended. They have different setting options in them including cleanup, etc., for instance, the CleanUp option will set delete your backdoor and set the machine back to its original state.
The registry methods in gaining persistence are one of the oldest methods which use the HKLM version to trigger our payload into the system. Couple of persistence that we will show in our article will have schtasks as an option. This option makes the module a bit trickier as it sets the payload to be triggered on either DailyTime i.e. any given time or using OnLogon option which triggers the payload user is logged on. The Onlogon option does not display a prompt and runs as SYSTEM.
The WMI module is mostly the go-to persistence method. It lets you add a permanent WMI payload at either DailyTime (i.e. at a certain time) or at startup. This module to runs as SYSTEM and it doesn’t depend on the user being logged in.
The modules of persistence that we are going to show in our article are as follows :

• Persistence/elevated/registry
  
• Persistence/elevated/schtask
  
• Persistence/elevated/wmi
  

• Machine discovery and scanning (netdiscover, nmap)
  
• Surfing HTTP service port (80)
  
• Directory enumeration using dirbuster
  
• Exploring directories on the browser.
  
• Adding domain name to /etc/hosts file.
  
• Exploring domain name on the browser.
  
• Directory enumeration using dirbuster
  
• Exploring directories on the browser.
  
• Searching exploits using searchsploit.
  
• Cracking base-64 encoded public key.
  
• Logging into SSH using the public key.
  
• Using online python-decompiler.
  
• Getting root access.
  
• Snagging the Root flag.
  

• Network scanning (Nmap)
  
• Surfing HTTP service port (80)
  
• Surfing HTTPS service port (1337)
  
• Surfing HTTPS service port (12320)
  
• Surfing HTTPS service port (12322)
  
• Browsing Directories on the browser
  
• Discovering LFI vulnerability.
  
• Enumerating through /etc/passwd file.
  
• Enumerating through /var/www/p4ss/.htapasswd file.
  
• Cracking password hash.
  
• Using Credentials to log into port 1337.
  
• Viewing Page source of Webpage.
  
• Find Hidden file using steghide.
  
• Using Credentials to log into port 12320.
  
• Creating Python exploit using Metasploit.
  
• Getting root access.
  
• Snagging the Root flag.
  

• Machine discovery and scanning(netdiscover, nmap)
  
• Surfing HTTP service port(80)
  
• Directory enumeration using dirbuster
  
• Extract steganographic content using steghide
  
• Extract file from a pcapng file using Wireshark
  
• Extract and decrypt hashes using John the Ripper
  
• Check contents of system-wide configuration files for credentials
  
• Privilege escalation using tar
  

Hello friends! Today we are going to take another boot2root challenge known as root this. The credit for making this VM machine goes to “Fred Wemeijer” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

• IP Discovery using netdiscover
  
• Network scanning (Nmap)
  
• Surfing HTTP service port (80)
  
• Directory enumeration using dirb
  
• Getting Backup file using wget
  
• Cracking password using fcrackzip
  
• Cracking Hashes using John the Ripper
  
• Getting Reverse Shell
  
• Getting a proper TTY shell using socat
  
• Cracking root password using sucrack
  
• Retrieving flag
  

We tried multiple ways to get a TTY shell, but are unable to spawn one with

• Introduction to command injection
  
• Introduction to Commix
  
• Working of Commix
  
• Types of Commix
  
• Requirements
  

• Classic result based injection : This is the most commonly used type of command injection and is the simplest of all. In this, several common operators are used which either links genuine commands with the injected ones or exclude the initial commands altogether and goes ahead to execute the injected ones only. this further divides into 3 categories i.e. Shellshock, ICMP exfiltration, DNS exfiltration.
  
• Eval-Based technique : This technique is used where the targeted web application is vulnerable to eval() function. This eval function is used to execute the peculiar code that is defined in the said function during run time.
  

• Time-based Technique : Using this technique will delay the time of the execution of a command that is injected. By checking how much time the application took to revert will able the attacker to determine whether the command is executed successfully or not.
  
• File-based Technique : If you are not able to determine the result of the web application through its reaction, then this technique comes in handy as it will allow you to write the set of commands that are to be injected in the file accessible to the attacker. Working of this technique is similar to that of result based technique.
  

• DVWA
  
• PentestLab
  
• Kali Linux
  
• Commix Tool
  

• Introduction of LaZagne Project
  
• Syntax and Parameters
  
• Achieve Meterpreter and Upload LaZagne
  
• Help Screen
  
• Mails Argument
  
• Windows Argument
  
• Browsers Argument
  
• Databases Argument
  
• Wi-Fi Argument
  
• All Argument
  
• oN Parameter
  
• Verbose Mode Parameter
  
• Quiet Parameter
  

• KeeThief
  
• mimipy
  
• mimikatz
  
• pypykatz
  
• creddump
  
• chainbreaker
  
• pyaes
  
• pyDes
  
• secretstorage and many more.
  

• Firefox
  
• Google Chrome
  
• Opera
  
• Skype
  
• Postgresql
  
• Thunderbird
  
• Keepass
  
• CoreFTP
  
• FileZilla and many more.
  

• Network scanning (Nmap)
  
• Surfing HTTPS service port (80)
  
• Directory enumeration using gobuster
  
• Logging in as a Guest User
  
• Enumerating for Login Credentials
  
• Logging in through zabbix–cli
  
• Giving permissions to access GUI
  
• Getting a reverse shell using zabbix exploit
  
• Retrieving User flag
  
• Modify the Environment PATH to run systemctl
  
• Snagging the Root Flag
  

[To see content please register here]

Today we are going to solve another CTF challenge “Giddy”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Giddy is 10.10.10.104

Penetrating Methodology

• Network scanning (Nmap)
  
• Surfing HTTPS service port (80)
  
• Directory Bruteforcing using dirb
  
• Discovering SQL Injection in URL
  
• Hosting directory using impacket
  
• Enumerating for password hashes
  
• Crack password hash using John the Ripper
  
• Connecting a new session with extracted login credentials
  
• Enumerating for user flag
  
• Using Evasion to bypass the Windows Defender
  
• Upload payload to the target and get a meterpreter session
  
• Snagging the Root Flag
  

• Introduction to IDS
  
• Categories of IDS
  
• Types of IDS
  
• Introduction to Snort
  

• Packet Decoder
  
• Pre-processors
  
• Detection Engine
  
• Logging and Alerting System
  
• Output Modules
  

• Dumping data from the Memcached server manually.
  
• Dumping data using libmemcached-tools.
  
• Dumping data using Metasploit.
  
• Monitoring using Watchers.
  

• Network scanning (Nmap)
  
• Logging in FTP using Anonymous Login
  
• Find Hidden file using steghide
  
• Bruteforce Login Credential using Burpsuite
  
• Manage Cookies using Burpsuite to get access
  
• Bruteforce all ports using wfuzz
  
• Retrieve version and password hashes on Memcached server
  
• Crack password hash using John the Ripper
  
• Bruteforce the credentials using Hydra
  
• Logging into the server using SSH and getting user flag
  
• Using ltrace to extract application password
  
• Compile the remaining function using gcc
  
• Snagging the Root Flag
  

TrevorC2 is a command and control framework. It is a client/server model that works through a browser masquerading as a C2 tool. It works at different time intervals which makes it almost impossible to be detected. This tool is coded in python but it’s also compatible with c#, PowerShell, or any other platform. this is supported by both Windows and macOS along with Linux. It is very easy and convenient to use.
You can download it from
git clone

[To see content please register here]

• Network scanning (Nmap)
  
• Scanning port 389 using LDAP script
  
• Fetching shared directory using smbclient and finding the private key
  
• Connecting to VM with SSH using the private key
  
• Enumerating files with SUID bit set
  
• Discovering that alice1978 can run ssh-keygen as userca
  
• Discovering authorized commands at ssh login
  
• Fetching principal using the curl command
  
• Enumerating public certificate in system
  
• Signing RSA key with ca certificate using doas command and previously found the principal
  
• Logging into ssh using new private key pair
  
• Snagging the flag
  

• Introduction to Memcached.
  
• Memcached Installation.
  
• Memcached Configuration.
  

In this article, we will show you the methods of protecting your system against MIMIKATZ that fetches password in clear text from wdigest. As you know the Pen-tester and the red team uses mimikatz for testing password capacity. For the complete information on how mimikatz works visit this link:

Table of Contents

• Introduction
  • System impacted
    
• Demonstration on Windows 7
  • Disable WDigest (defending against mimikatz)
    
• Demonstration on Windows 10
  • Enable WDigest in Windows 10
    
  • Enable WDigest via the registry key
    

• Exploiting through HTA
  
• Exploiting through MSBuild.exe
  
• Exploiting through regsvr32
  
• XSL exploit
  
• Exploiting through a visual basic script
  
• BAT exploit
  
• Multi_launcher exploit
  

• Install Java
  
• Import the GPG keys
  
• Add the Jenkins repository
  
• Install Jenkins
  
• Setup Jenkins
  

A huge shoutout to cybersecurity researcher John Page for bringing this vulnerability into the internet’s eye on 15th January 2019. This was a 0 day exploit and of course, works with the latest Windows 10 too. It is categorized under “Insufficient UI warning remote code execution” vulnerability.
Introduction: Basically what John discovered was that if we replaced the website in a VCF file with the local path of a CPL file, it tends to install that file instead of opening it on the browser. This is done by replacing the “http://” with “http.\\”, which is totally insane since a user would need the eyes of multi megapixels to discover an intentional path error of that kind! So all we need to do is to send the victim that VCF file along with our CPL file in a folder named “HTTP” (it has to be HTTP only for local path inclusion) and we shall get a shell.
To read more about the research follow the link

[To see content please register here]

• Making an msfvenom windows payload with the .dll extension.
  
• Sending the dll file in a folder named “HTTP”.
  
• Creating a contact file in the parent folder of “HTTP”.
  
• Adding a website into the contact.
  
• Changing the prefix of the website from http:// to http.\\
  
• Renaming the dll file to “<name of website>.cpl”
  
• Running multi handler in a window
  
• Opening the website path from the contact
  
• Spawning shell.
  

• Introduction to Firewall
  
• Rules of Firewall
  
• Advantages of Firewall
  
• Types of Firewall
  
• Importance of firewall
  
• Introduction to netsh
  
• How to block a TCP Port on remote PC
  
• How to block multiple TCP ports
  
• How to view firewall rules
  
• How to delete firewall rules
  
• How to add firewall rules
  
• View current profile status
  
• Modifying the firewall further
  

• Network isolation
  
• Network flexibility
  
• No malware protection is required
  
• No maintenance
  

• Packet filtering firewall
  
• Circuit lever firewall
  
• Stateful inspection firewall
  
• Application-level firewall
  
• Next-gen firewalls
  

• It protects your computer from unauthorized remote access
  
• It blocks linking your messages to unwanted content
  
• It will block unnecessary and immoral content
  
• It matches the details of data packets for reliable information.
  
• IP and Domain can also be blocked or allowed.
  

Once you execute the above code, all outbound requests to any host on port 80 will be blocked, and it adds an entry to the Windows firewall:

• Making an msfvenom payload of a .vbs format.
  
• Sending the VBS file to the victim.
  
• Creating a VCF file in the parent folder.
  
• Adding an email into the contact with HTML injection parameters.
  
• Running multi/handler in a separate window.
  
• Opening email in the VCF file.
  
• Spawning meterpreter.
  

• GreatSCT
  
• Installation & Usages
  
• Generate malicious hta file
  
• Generate malicious sct file
  
• Generate malicious dll file
  

• Installutil.exe : The Installer tool is a command- line tool that lets you install and uninstall server resources in specific assemblies by running the installer components.
  
• Msbuild.exe : The Microsoft Build Engine is a platform for building applications. This engine, which is also known as MSBuild.
  
• Mshta.exe : Mshta.exe runs the Microsoft HTML Application Host, the Windows OS utility responsible for running HTA( HTML Application) files. HTML files that we can run JavaScript or Visual with.
  
• Regasm.exe : The Assembly Registration tool reads the metadata within an assembly and adds the necessary entries to the registry, which allows COM clients to create .NET Framework classes transparently.
  
• Regsvcs.exe : RegSvcs stands for Microsoft .NET Remote Registry Services it is known for .NET Services Installation.
  
• Regsvr32.exe : Regsvr32 is a command line utility for register and unregister OLE controls in the Windows Registry, such as DLLs and ActiveX controls.
  

This article demonstrates the most common and familiar techniques of whitelisting AppLocker bypass. As we know for security reason the system admin add group policies to restrict app execution for a local user. In our previous article, we had discussed on “Windows Applocker Policy – A Beginner’s Guide” as they define the AppLocker rules for your application control policies and how to work with them. But today you will learn how to bypass Applocker policies with RunDLL files.

Tables of Content

• Introduction
  
• Working of DLL files
  
• Advantages
  
• Disadvantages
  
• Different methods for AppLocker Bypass using DLL files
  
• Conclusion
  

• Uses fewer resources
  
• Promotes modular architecture
  
• Eases deployment and installation
  

• A dependent DLL is upgraded to a new version.
  
• A dependent DLL is fixed.
  
• A dependent DLL is overwritten with an earlier version.
  
• A dependent DLL is removed from the computer.
  

• Smb_Delivery
  
• MSFVenom
  
• Koadic
  
• Get-Command Prompt via cmd.dll
  
• JSRat
  

• Introduction to regsvr
  
• Working of regsvr
  
• Multiple methods to attack regsvr
  

• Web delivery
  
• Empire
  
• Manual
  
• MSFVenom
  
• Koadic
  
• JSRat
  
• GreatSCT