Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Windows Hidden Bind Shell

In this article, we are going to cover the tactics of Hidden BIND TCP shellcode. Every organization has multiple scanning tools to scan their network and to identify the new or unidentified open ports. In this type of environment, it's very difficult to hide the suspicious bind shellcode and remains unnoticed from the reach of their scanning tools.

<o:p

But how can we sit idle without the set of a new idea? We are here with the concept of Hidden Bind TCP shell, this shellcode listens to the connection only from the allowed IP address of the host (I.e Ahost), and for other connections, it replies with an RST packet, (A reset packet is simply one with no payload and with the RST bit set in the TCP header flags). This is the way the port will appear as “closed” and help us to hide the shellcode.<o:p

Pre-requisites for Lap Set up<o:p

· Kali Linux(Pentester’s Machine)<o:p

· Window 10 (Victim’s Machine)<o:p

· Zenmap Tool

Let's Begin!!<o:p

Using the msfvenom, we are going to create a payload for windows by shell_hidden_bind_tcp and will save it in the exe format name as file.exe, now we will send the file on the victim’s PC and execute that malicious file.exe on the victim’s system. it will open a new service on the victim’s pc having port number 4321 which makes the connection with the pentester’s IP. <o:p

https://1.bp.blogspot.com/-YP3OWLpM1cY/YQQpeJswtrI/AAAAAAAAyCc/cADYfBY9V54b3PmfCXVEBRDMhxrC_zIdACLcBGAsYHQ/s16000/1.png
Now, In case the victim runs the netstat command, which will display all the active connections as showing in the below screenshot. In the output, port 4321 does not have an IP address but it appears as some internal services are running through local or internal connections. On the other hand, the connection is already established with the Pentester’s IP.

https://1.bp.blogspot.com/-43cZLZadKDc/YQQpinfQelI/AAAAAAAAyCg/h60bcBL2ZKE1CVXi1n13xvCDwJ-S1sqtgCLcBGAsYHQ/s16000/2.png
<o:p

If the victim wants to verify the service for unknown port 4321 and will try to scan that port using the Zenmap tool, the result of the Nmap will show the closed state of port 4321 which means its undetectable through the scanning tool, on the other hand, it is making a connection with the Pentester’s IP.<o:p

https://1.bp.blogspot.com/-gWfj3rAkc_0/YQQpmWFjxzI/AAAAAAAAyCk/DJ6UmUx6-70_AJHv44zkvjUHIVh31HGHQCLcBGAsYHQ/s16000/3.png
On the other side, if we scan the same port from outside the network of the victim through Kali. The result of the same Nmap command shows the open state of port 4321.<o:p

<o:p

https://1.bp.blogspot.com/-D6y0MOiVCa8/YQQpqLzkb9I/AAAAAAAAyCo/dYxfekAxKl478zeI-dJzbYrXj4Wr72uJgCLcBGAsYHQ/s16000/4.png
This is the magic of the hidden shellcode to remain undetectable from the reach of different scanning tools.<o:p

As we have already executed malicious payload file.exe on the victim’s PC so through the netcat we have a session.<o:p

https://1.bp.blogspot.com/-bAMvFjoiF8Q/YQQpt24GjGI/AAAAAAAAyCs/JwUVSjaH87UgV_tv1qBWMijdzsNk5hPOwCLcBGAsYHQ/s16000/5.png

11 views17:53

Photo

Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Creds

This is in continuation with the Metasploit for Pentester series of articles that we are presenting. More specifically we learned about the Workspaces and the Metasploit Database service in this article: Metasploit for Pentester: Database & Workspace. In this article, we will be discussing another database inside the Workspace that can be used by Penetration Testers: Creds. Table of Content<o:p· Recap and DB Initialization <o:p· Introduction<o:p· Extracting Creds<o:po From Bruteforce<o:p

o From Mimikatz <o:p

o From Telnet<o:p

o From SMB<o:p

o From Hashdump<o:p

o From SSO<o:p

· Search Filter<o:po By Username<o:p

o By Type<o:p

o By Port<o:p

o By Host<o:p

o By Service<o:p

· Adding Credentials<o:p· Exporting Credentials<o:p· Conclusion<o:pRecap and DB Initialization<o:pWithout repeating but having a small recap of the facts that we learned in the Workspace article that, Metasploit has a Postgres SQL database at its disposal inside which Penetration Testers can create Workspace for their usage. This Workspace has some sub-sections such as the hosts and vulns that hold the various hosts enumerated by the users with the help of the db_nmap and Metasploit auxiliaries. Among those databases, we have another type of database that is called creds. Before beginning, with its functionalities, let’s initiate the database with the help of the following command. <o:p msfdb init<o:phttps://1.bp.blogspot.com/-L6TAAMCdKQk/YQQ0TSssW-I/AAAAAAAAyDA/7JXUZms3Md0eZUTwugSLoZDHixYvDIKzgCLcBGAsYHQ/s16000/1.png Introduction <o:pAfter initializing, just by running the creds command, we can see the table that will hold the data enumerated by the user. It contains the following columns: hosts for holding the primary key i.e., IP Addresses of the targeted hosts, the origin will store the location where we were able to grab the creds from, service will feature the particular service running on the hosts that made it possible to the extraction of the creds, public and private are just the holders for the public variable which in most cases is the username and private as you might have guessed it the password. We have some other columns that we will get into later. However, we have a column by the name of JtR Format. It will contain the format that can be used with John the Ripper tool to decode.<o:p creds<o:phttps://1.bp.blogspot.com/-LJfjvZRaA54/YQQ2wQdTZFI/AAAAAAAAyDI/4pJTNa7O3HAVoIYCDVKMMPTkXWcCS0aBQCLcBGAsYHQ/s16000/2.png Extracting Creds: Bruteforce <o:pWe discussed in the Introduction section that the creds table will populate with the correct credentials that we enumerate using the auxiliaries from Metasploit. To demonstrate the collection of creds from Bruteforce, we will be targeting the FTP service running on a server. We used the ftp_login exploit to attempt to Bruteforce the credentials. We provided the host with the User File with the possible usernames, pass a file with possible passwords. After running through, the list of usernames and passwords, the exploit was able to grab the correct credentials as username privs and password 123. After successful extraction of the credentials, we ran the creds command and we can observe that the creds table has its very first entry as demonstrated in the image below<o:p use auxiliary/scanner/ftp/ftp_login<o:pset rhosts 192.168.1.40<o:pset user_file /root/users.txt<o:pset pass_file /root/pass.txt<o:pset verbose false<o:pset stop_on_success true<o:pexploit <o:pcreds<o:phttps://1.bp.blogspot.com/-yGC6e6IXnOk/YQQ202wZ3DI/AAAAAAAAyDM/odIDztwwc[...]

7 views17:53

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Metasploit for Pentester: Creds This is in continuation with the Metasploit for Pentester series of articles that we are presenting. More specifically we learned about the Workspaces and the Metasploit Database service…

jY1z57lVap6tza30g62gjwuQCLcBGAsYHQ/s16000/3.png Extracting Creds: Mimikatz<o:pWe are not going to use the Mimikatz directly on our target but we will be using the Meterpreter external extension called kiwi. To use Mimikatz, we will be initially compromising a Windows Machine and gain a meterpreter session on it. After gaining the meterpreter, we will load the kiwi module and run the creds_all command to gain all the possible credentials. Passwords, hashes from the compromised machine. We can see that we can enumerate the NTLM hashes and some clear text passwords with the help of the kiwi module. <o:p load kiwi<o:pcreds_all<o:phttps://1.bp.blogspot.com/-sp64sLERL_g/YQQ25KJBOPI/AAAAAAAAyDQ/y1s2637m3oYe4B5YbtgabFM7Wb0Y2pemQCLcBGAsYHQ/s16000/4.png Let’s run the creds command again to see if the recently enumerated creds are populated inside the table. We can observe that we have the clear text password and the NTLM hashes added into the creds table. We can see that the host that we extracted the NTLM hash is the Windows Machine running with the IP Address of 192.168.1.21 and the FTP service was running on the machine with the IP Address 1922.168.1.40<o:p https://1.bp.blogspot.com/-wiNmwrwiivc/YQQ29cfhVNI/AAAAAAAAyDU/r5OjjiwgxUoGOidGIgMz-p2G1NpocrapwCLcBGAsYHQ/s16000/7.png Extracting Creds: Telnet<o:pMoving on from the FTP service and the NTLM hashes, it’s time to extract some telnet credentials with the help of another Metasploit auxiliary called capture/telnet. We are targeting the machine with the IP Address of 192.168.1.3 and we can see that the captured credentials are ignited/123. As always running the creds command can confirm that the creds table is successfully populated with the Telnet credentials.<o:p use auxiliary/server/capture/telnet<o:pset srvhost 192.168.1.9<o:pexploit<o:pcreds<o:phttps://1.bp.blogspot.com/-t_V3ibhnItk/YQQ3CVpo0II/AAAAAAAAyDc/Z4oJ3OmGNdcpDYQBhdaFEvIjxbwQOZN9gCLcBGAsYHQ/s16000/8.png Extracting Creds: SMB<o:pNext, we will be targeting the Windows Machine with the SMB capture and generate the response to capture the NTLM hashes. We will be using the auxiliary/server/capture/smb and auxiliary/spoof/nbns/nbns_response exploits to get the NTLM hashes. We provided the host for serving the capture and the path to the john password file to be saved. Also, we provided the spoof IP Address and we have the NTLM hashes as shown in the image below.<o:p use auxiliary/server/capture/smb<o:pset srvhost 192.168.1.9<o:pset johnpwfile /root/Desktop<o:pexploit<o:puse auxiliary/spoof/nbns/nbns_response<o:pset spoofip 192.168.1.9<o:pset interface eth0<o:pexploit<o:phttps://1.bp.blogspot.com/-T_kQJShityk/YQQ3Hk7QJzI/AAAAAAAAyDg/YWgyJZbCSmw1g4O6fExb7Kf0gy87DvvXQCLcBGAsYHQ/s16000/9.png Since we were successful in capturing the NTLM hashes from the target machine, these will automatically populate the creds table. We can check these entries by running the creds command as shown in the image below.<o:p https://1.bp.blogspot.com/-4Y1oiWLa6Do/YQQ3QQv5djI/AAAAAAAAyDo/oplgS_wdwdQkkpNJSu9tX2R6tH_L-FSbwCLcBGAsYHQ/s16000/10.png Extracting Creds: Hashdump<o:pMoving on from NTLM hashes on Windows to Hashes on Linux machines. To enumerate the hashes, we will be using the Hashdump post-exploitation module on Metasploit. After exploiting a Linux Machine, we can use this post-exploitation module to gather all the hashes of the users on the compromised machine. We can see from the image below that the extracted hashes have been added to the creds table.<o:p use post/linux/gather/hashdump<o:pset session 3<o:pexploit<o:phttps://1.bp.blogspot.com/-2d029Nv37bQ/YQQ3XSp4NmI/AAAAAAAAyD0/bI7gEQEvhRULI2pNKXVt-ibjfGZJGOcyACLcBGAsYHQ/s16000/11.png It is not always necessary to run the post-exploitation module as demo[...]

5 views17:53

About

Blog

Apps

Platform