Development: Vulnhub Walkthrough

Today we are going to take on another challenge known as “DEVELOPMENT”. This is designed for OSCP practice, and the original version of the machine was used for a CTF. It is now revived and made

slightly more nefarious than the original. The author of this VM machine is “Donavan”. Our goal is to get flag to complete the challenge.

Download it from here: https://download.vulnhub.com/digitalworld/devt-improved.7z

Security Level: Intermediate
Penetrating Methodology:

Scanning

·         Netdiscover

·         NMAP

Enumeration

·         Run http service

·         Web spidering

Exploiting

·         Remote File Inclusion

·         Ssh login

Privilege Escalation

·         Exploit sudo rights

·         adding new user

Capture the Flag

Walkthrough

Scanning:

Let’s start off by scanning the network and identifying host IPs. As illustrated below, we can identify our host IP as 192.168.1.104.

netdiscover

Time to scan the Target’s IP with Nmap.

nmap -sV  192.168.1.104

We can clearly see from screenshot a few open ports e.g. 22(ssh),139(NetBIOS-ssn), 445(NetBIOS-ssn), 8080(http-proxy).

Enumeration:

Since port 8080 is running HTTP-proxy, so our obvious choice is to browse Target’s IP in browser. Here we

got a clue about some html_pages. It could either be any Directory or a webpage.

So, let’s dig into the source code if we can find something useful. Here they are talking about some Development secret page and Patrick is being mentioned, he could be a user:

Now moving ahead, lets surf through the webpage mentioned earlier which is html_pages .Here again we can see a few html files in which “development.html” could be of our interest.

When you visit development.html, you can find a mention of “hackersecretpage” nothing else seems useful.

Again we went through the source code of the same and found “./developmentsecretpage” .This seems our secret page.

If you visit the page, it is confirming to be the Development secret page and a PHP file link named ‘Patrick’.

If we visit the file link it opens a page with another file included in it named ‘Sitemap’.

And when we visit /sitemap.php, we clicked on the embedded link stating “Click here to logout” which turned out to be Login page.

Exploitation

We just tried random login credentials “admin” for both username and password and 1234 that’s a success.  

Here we are getting a short of error message on the top of the page. So we Googled about it.  

We found an exploit for the same listed on Exploit-db with the name of “/[path]/slog_users.txt” which is vulnerable to RFI. Refer CVE code :2008-5762/63.

When we appended slog_users.txt file with our webpage we found four users and their password hashes.

After decrypting the hashes, we got passwords in clear text for intern, Patrick and qiu respectively but not for Admin.

Priviledge Escalation:

As we knew port 22 is open for ssh so here I try to login into ssh using intern and we got access of ssh as shown below. After that we found list of commands that are allowed to run here. Then we check list of files using ‘ls’ as it was one of the allowed commands. We found two text files here ‘local.txt’ and ‘work.txt’ but when we try to open them, we failed.

ssh intern@192.168.1.104

?

ls

cat local.txt

Hmm! we got access of restricted shell where we can run only few commands allowed by admin. So, to import proper tty shell, we can import ‘/bin/bash’ by using following command:

echo os.system(‘/bin/bash’)

cat local.txt

cat work.txt

Next, we try again accessing the same ‘local.txt’ file and it just shows a congratulatory message, so we moved on to work.txt, here as well it is showing we have to move further with user Patrick and we already knew Patrick’s password.

NOTE: At first attempt, you will get an error SSH connection refuse, therefore restart the Vulnerable machine to get connect with SSH.

After logging in as patrick, we check the sudo rights for him where I found Patrick has ALL Users permissions including root user to run vim and nano as shown below.

su patrick

sudo -l

In another terminal in my local machine I have generated a new encrypted password: pass123 whose salt is ignite using OpenSSL and copy the salt password.

openssl  passwd  -1  -salt  ignite pass123

Next by providing sudo access to any editer(either vim or nano ) we can read as well as  edit any system file which is restricted to access by any lower privilege user such as /etc/passwd file.  

Since Patrick has sudo rights which means he can modified the root files too, therefore I decided to insert a new user with root privilege in the /etc/passwd file.

sudo nano /etc/passwd

As you can see in the screenshot below, we have added a user ‘RAJ’ and with encrypted password and we have given all root privileges to it as well.

raj:$1$ignite$3etbJm9809Hz.K1NTdNxe1:0:0:root:/root:/bin/bash

Capturing the flag

What we are waiting for, lets login using raj. Here after listing the content we found proof.txt file from inside root directory. we opened it using cat and captured the flag.

su raj

ls

cat proof.txt

DC-4 Vulnhub Walkthrough

Today we are going to take another boot2root challenge known as “DC-4”. The credit for making this VM machine goes to “DCAU” and it is another boot2root challenge in which our goal is to get root access to complete the challenge. You can download it from here
Security Level: Beginner

Penetrating Methodology

Scanning

·        Discovering Targets IP

·        Network scanning (Nmap)

Exploiting

·        Surfing HTTP service port

·        HTTP Login credential Bruteforce (Burpsuite)

·        Command Injection

·        SSH Login Credentials Bruteforce (Hydra)

Lateral Moment

·        Logging into SSH and Enumerating Directories

·        Obtain credentials in /var/mail directory

Privilege Escalation

·        Check Sudo rights

·        Adding new user /etc/passwd with sudo

·        Access root directory

·        Capture the flag

Walkthrough
Scanning
Let’s start off with scanning the network to find our target.
netdiscover

We found our Targets IP Address 192.168.1.101. Our next step is to scan our targets IP Address with nmap.

nmap -A 192.168.1.101

Exploiting

From nmap result we found HTTP service is running on port 80. So, we browsed the Targets IP Address in the browser and found an Admin Information Security Login page. We clearly need to find credentials for it.  Let’s work on that.

We found that the HTTP service runs on port 80, from nmap results. So, we browse the IP address of Targets in the browser and found the Admin Information Security Login page. Now credentials need to be found for login, Let's work on this.

We Fired UP!! burpsuite using rockyou.txt to get valid login.

Username- admin

After bruteforcing, we have found the password for Admin i.e

Password- happy

We have successfully logged in as Admin. Under system tools, the hyperlink command looks suspicious here. So, let’s check it out.

Command option looks useful as It displayed some options to Run Command. Here we used list file option which displayed files of the database. We also got a hint from the ls command which executes ls-l, we might make some changes in it.

So, we captured the Webpage request using Burpsuite and Send the request to repeater. Here we can make the desired changes to the request and check out its response.

Let’s check out subdirectories in the /home directory. We have found 3 users i.e Charles, Jim and Sam.

Exploring the home directory for user Jim, after that we checked out the backups folder.

We have found a old-passwords.bak file which is a backup password file.

Exploring the contents of the file, we found a list of passwords. They might come in handy later.

We thought of checking /etc/passwds is readable or not and found some useful usernames.

We have created a dictionary for users and passwords with the previously discovered credentials. Let’s bruteforce for ssh login using hydra.
hydra -L users -P passwords 192.168.1.101 ssh
So, the credentials found:

Login- jim

Password- jibril04

Lateral Moment

Logging into ssh using the credentials.
Username- jim
Password- jibril04
ssh jim@192.168.1.101
While enumeration, we found two files and read their contents. But they didn’t give direct clue to move ahead.

ls

cat test.sh

cat mbox

when I open mbox, I saw a test mail in this, send by root to jim.

After some time thinking, it suddenly strikes us to check the /var/mail folder. Maybe it might contain something, and our instinct was right. We have found some credentials.

Username- Charles

Password- ^xHhA&hvim0y

Privilege Escalation
Let’s login into charles with password ^xHhA&hvim0y.
su charles
After enumeration, we check sudo right for Charles and found that he run the editor teehee as root with no password. After that we have added raaj in the etc/passwd using echo and teehee as shown.
sudo -l
echo "raj::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
Logging into raaj as root user and inside the root directory, we have found our FINAL FLAG.

su raaj

cd /root

ls

cat flag.txt

Author: Ashray Gupta is a Security Researcher and Technical Writer at Hacking Articles. Contributing his 3 years in the field of security as a Penetration Tester and Forensic Computer Analyst. Contact Here

Get Meterpreter Session Alert over slack

You're going to learn ShellHerder in this post. It is a technique used to monitor all the sessions of Metasploit/Meterpreter. The basic idea to create it, that new incoming sessions could be easily monitored when Intruder cannot access the listener. This approach is quite helpful when a Pen-tester wants to get an alert for live phishing campaigns or other attack by monitoring for new sessions.

Table of Content

Introduction to ShellHerder

Registering on Slack

·         Add WebHooks App

·         Configure WebHooks App

Download & Configure ShellHerder

Working Demo

Introduction to ShellHerder

ShellHerder uses session subscriptions to monitor activity and then sends an alert to Slack using Slack's Incoming WebHooks. The alert is sent using the WebHook URL and a POST request and will tag a specified username and provide the computer name of the server with the session.

Registering on Slack

We need a workspace on slack to use slack. To do this we need to register on slack. To create a new workspace on slack, click here. This will require an email address. After that it is required to create a channel. Here, we named our channel “liveserver”.

Add WebHooks App

To receive the updates from the Metasploit, we need to an app installed in the channel. Webhooks is the app that is perfect for this job. Now in order to add Webhooks, we first clicked on the Add an app Button inside our channel. Now, we will search for incoming Webhook and add it.

Configure WebHooks App

After adding the Webhooks, we will be asked to configure some settings for the app. This will include the configuring the channel on which the incoming notifications will be broadcasted. Here we select our channel and click on the Add Integration Button.

After clicking the Add integration button, we will be presented with the WebHooks URL. Copy this URL, we are going to need it while we configure Notify.

Download & Configure ShellHerder

Now, we need to work upon our Kali Linux. We are going to use Shell Herder to connect to slack. This Metasploit plugin is aimed to keep an eye on the sessions. All including the ones which are opened or closed. It uses session subscriptions to monitor activities and can be linked to slack, which we just got setup.

git clone https://github.com/chrismaddalena/ShellHerder.git

After downloading Shell Herder via git clone, we moved the directory inside the Metasploit Framework. So that we can use it directly inside the Framework. After copying the directory, we open an instance of the Metasploit Framework and load the notify plugin as shown in the image given image.

Now, we will use the command notify_show_options to check for any pre-configured settings. Now that we can’t find any. It was time to set the Webhook URL, which we copied earlier and add it inside the notify plugin. Also, we set the Slack User id and Source. After entering the relevant data, use the save command to save the configuration. Now that we have configured the Notify, Let us send a test message to see if the configuration is correct and working.

load notify

notify_show_options

notify_set_webhook

notify_set_user @Ignitelab

notify_set_source Kali-Linux

notify_save

notify_test

As we can see in the given image that, the slack received the test message we sent via Notify.

Working Demo

Now, to test the real working of Notify, we will exploit a machine, so that we can observe, whether or not it will notify us, when we get a session. We are exploiting a Windows machine using web delivery.

As we expected, we got the notification on our slack channel, as soon as we got the session.

Born2Root: 2: Vulnhub Walkthrough

Hello Friends!! Today we are going to take another CTF challenge named “Born2Root: 2”. The credit for making this VM machine goes to “Hadi Mene”. It is available on the Vulnhub website. Although there is no description provided at the current time on the Vulnhub website, we assume that we will have to gain the root access and find a flag.

Security Level: Intermediate

Penetrating Methodology

Walkthrough

Let’s start off with scanning the network to find our target.

Netdiscover

We found out target: 192.168.1.9

Time to scan the Target’s IP with nmap. Nmap scan result shows 3 major ports open, 22(SSH), 88(HTTP) and 111(RPC).    

nmap -A 192.168.1.9

Since port 80 is running HTTP, so we considered opening the Target IP Address on the Browser. This gives us an attractive looking webpage although after spending a considerable amount of time. We found that this is nothing but a distraction. We couldn’t find anything of importance on the website. 

So now we moved on to try the Directory Bruteforcing to get any hints. The drib scan gives us the joomla directory. This is a major breakthrough. Now it’s time to exploit machine through joomla.

dirb http://192.168.1.9/

Now that we have found the joomla directory, we will browse the joomla directory on our browser. Here we have the blog made by the author. This is titled Tim’s Blog. This could be a hint for a username. Let’s keep that in mind. Now as we can see that we have a Login Form in the bottom right. Now we will have to guess the user credentials.

Now, it is by convention to try the default credentials first. A quick search, informs us that the default username for joomla is ‘admin’. Now for the password, we will have to perform a dictionary attack. For that, we will create a dictionary from the words present on the webpage using ‘cewl’.

cewl http://192.168.1.9/joomla/ > dict.txt

Now that we have the dictionary named dict.txt. Its time to perform the bruteforce. We will use the BurpSuite to perform the bruteforce. To learn more about this, refer to this article. This bruteforce force gives us “travel” as the password.

Now we will use these credentials to login in Joomla:

Username: admin

Password: travel

Now that we have logged in on the joomla as the SuperUser. To exploit the joomla server, we will use the php reverse shell. They can be found in Kali Linux. We will move on to the Template Section. To do so, we will first click on the Extensions Option on the Menu. Then, traverse in the beez3 template and choose Customise. This is open an edit section as shown in the image. Now, select the index.php and replace the text inside the index.php with our reverse shell. Remember to change the IP Address and/or change the port.

After editing the index.php, save the file by clicking on the Save Button. Now we have successfully replaced the index.php with our reverse shell script. Now, all that’s left to do is run the index.php. Now to get a session, we need a listener, where we will get our reverse shell. We will use netcat for creating a listener as shown in the image given below.

After we got the shell, now it was time to enumerate the machine in order to exploit further. It took us a couple of hours of hard work around the machine. We ran a bunch of scripts and much else. At last, our search at the ended when we stumbled upon the opt directory. Inside this directory, we found the scripts directory and that contained the fileshare.py. Upon close inspection of the fileshare.py file, we got the login credentials as shown in the given image.

nc -lvp 1234

python -c 'import pty;pty.spawn("/bin/bash")'

cd /opt

ls

cd scripts

ls

cat fileshare.py

After finding the credentials all that was left was to login as Tim. For that we used the su command and gave the following credentials:

Username: tim

Password: lulzlol

After logging in as Tim, we ran the sudo with -l parameter to give us the user rights of the user tim. As we can see in the given image, tim has all the permissions. After this, we traversed inside the root directory using the cd command. Here we found the final flag.

su tim

sudo -l

sudo su

cd /root

ls

cat flag.txt