Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Windows Hidden Bind Shell

In this article, we are going to cover the tactics of Hidden BIND TCP shellcode. Every organization has multiple scanning tools to scan their network and to identify the new or unidentified open ports. In this type of environment, it's very difficult to hide the suspicious bind shellcode and remains unnoticed from the reach of their scanning tools.

<o:p

But how can we sit idle without the set of a new idea? We are here with the concept of Hidden Bind TCP shell, this shellcode listens to the connection only from the allowed IP address of the host (I.e Ahost), and for other connections, it replies with an RST packet, (A reset packet is simply one with no payload and with the RST bit set in the TCP header flags). This is the way the port will appear as “closed” and help us to hide the shellcode.<o:p

Pre-requisites for Lap Set up<o:p

· Kali Linux(Pentester’s Machine)<o:p

· Window 10 (Victim’s Machine)<o:p

· Zenmap Tool

Let's Begin!!<o:p

Using the msfvenom, we are going to create a payload for windows by shell_hidden_bind_tcp and will save it in the exe format name as file.exe, now we will send the file on the victim’s PC and execute that malicious file.exe on the victim’s system. it will open a new service on the victim’s pc having port number 4321 which makes the connection with the pentester’s IP. <o:p

https://1.bp.blogspot.com/-YP3OWLpM1cY/YQQpeJswtrI/AAAAAAAAyCc/cADYfBY9V54b3PmfCXVEBRDMhxrC_zIdACLcBGAsYHQ/s16000/1.png
Now, In case the victim runs the netstat command, which will display all the active connections as showing in the below screenshot. In the output, port 4321 does not have an IP address but it appears as some internal services are running through local or internal connections. On the other hand, the connection is already established with the Pentester’s IP.

https://1.bp.blogspot.com/-43cZLZadKDc/YQQpinfQelI/AAAAAAAAyCg/h60bcBL2ZKE1CVXi1n13xvCDwJ-S1sqtgCLcBGAsYHQ/s16000/2.png
<o:p

If the victim wants to verify the service for unknown port 4321 and will try to scan that port using the Zenmap tool, the result of the Nmap will show the closed state of port 4321 which means its undetectable through the scanning tool, on the other hand, it is making a connection with the Pentester’s IP.<o:p

https://1.bp.blogspot.com/-gWfj3rAkc_0/YQQpmWFjxzI/AAAAAAAAyCk/DJ6UmUx6-70_AJHv44zkvjUHIVh31HGHQCLcBGAsYHQ/s16000/3.png
On the other side, if we scan the same port from outside the network of the victim through Kali. The result of the same Nmap command shows the open state of port 4321.<o:p

<o:p

https://1.bp.blogspot.com/-D6y0MOiVCa8/YQQpqLzkb9I/AAAAAAAAyCo/dYxfekAxKl478zeI-dJzbYrXj4Wr72uJgCLcBGAsYHQ/s16000/4.png
This is the magic of the hidden shellcode to remain undetectable from the reach of different scanning tools.<o:p

As we have already executed malicious payload file.exe on the victim’s PC so through the netcat we have a session.<o:p

https://1.bp.blogspot.com/-bAMvFjoiF8Q/YQQpt24GjGI/AAAAAAAAyCs/JwUVSjaH87UgV_tv1qBWMijdzsNk5hPOwCLcBGAsYHQ/s16000/5.png

11 views17:53

Photo

Hacking Articles|Raj Chandel's Blog
Metasploit for Pentester: Creds

This is in continuation with the Metasploit for Pentester series of articles that we are presenting. More specifically we learned about the Workspaces and the Metasploit Database service in this article: Metasploit for Pentester: Database & Workspace. In this article, we will be discussing another database inside the Workspace that can be used by Penetration Testers: Creds. Table of Content<o:p· Recap and DB Initialization <o:p· Introduction<o:p· Extracting Creds<o:po From Bruteforce<o:p

o From Mimikatz <o:p

o From Telnet<o:p

o From SMB<o:p

o From Hashdump<o:p

o From SSO<o:p

· Search Filter<o:po By Username<o:p

o By Type<o:p

o By Port<o:p

o By Host<o:p

o By Service<o:p

· Adding Credentials<o:p· Exporting Credentials<o:p· Conclusion<o:pRecap and DB Initialization<o:pWithout repeating but having a small recap of the facts that we learned in the Workspace article that, Metasploit has a Postgres SQL database at its disposal inside which Penetration Testers can create Workspace for their usage. This Workspace has some sub-sections such as the hosts and vulns that hold the various hosts enumerated by the users with the help of the db_nmap and Metasploit auxiliaries. Among those databases, we have another type of database that is called creds. Before beginning, with its functionalities, let’s initiate the database with the help of the following command. <o:p msfdb init<o:phttps://1.bp.blogspot.com/-L6TAAMCdKQk/YQQ0TSssW-I/AAAAAAAAyDA/7JXUZms3Md0eZUTwugSLoZDHixYvDIKzgCLcBGAsYHQ/s16000/1.png Introduction <o:pAfter initializing, just by running the creds command, we can see the table that will hold the data enumerated by the user. It contains the following columns: hosts for holding the primary key i.e., IP Addresses of the targeted hosts, the origin will store the location where we were able to grab the creds from, service will feature the particular service running on the hosts that made it possible to the extraction of the creds, public and private are just the holders for the public variable which in most cases is the username and private as you might have guessed it the password. We have some other columns that we will get into later. However, we have a column by the name of JtR Format. It will contain the format that can be used with John the Ripper tool to decode.<o:p creds<o:phttps://1.bp.blogspot.com/-LJfjvZRaA54/YQQ2wQdTZFI/AAAAAAAAyDI/4pJTNa7O3HAVoIYCDVKMMPTkXWcCS0aBQCLcBGAsYHQ/s16000/2.png Extracting Creds: Bruteforce <o:pWe discussed in the Introduction section that the creds table will populate with the correct credentials that we enumerate using the auxiliaries from Metasploit. To demonstrate the collection of creds from Bruteforce, we will be targeting the FTP service running on a server. We used the ftp_login exploit to attempt to Bruteforce the credentials. We provided the host with the User File with the possible usernames, pass a file with possible passwords. After running through, the list of usernames and passwords, the exploit was able to grab the correct credentials as username privs and password 123. After successful extraction of the credentials, we ran the creds command and we can observe that the creds table has its very first entry as demonstrated in the image below<o:p use auxiliary/scanner/ftp/ftp_login<o:pset rhosts 192.168.1.40<o:pset user_file /root/users.txt<o:pset pass_file /root/pass.txt<o:pset verbose false<o:pset stop_on_success true<o:pexploit <o:pcreds<o:phttps://1.bp.blogspot.com/-yGC6e6IXnOk/YQQ202wZ3DI/AAAAAAAAyDM/odIDztwwc[...]

7 views17:53

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Metasploit for Pentester: Creds This is in continuation with the Metasploit for Pentester series of articles that we are presenting. More specifically we learned about the Workspaces and the Metasploit Database service…

jY1z57lVap6tza30g62gjwuQCLcBGAsYHQ/s16000/3.png Extracting Creds: Mimikatz<o:pWe are not going to use the Mimikatz directly on our target but we will be using the Meterpreter external extension called kiwi. To use Mimikatz, we will be initially compromising a Windows Machine and gain a meterpreter session on it. After gaining the meterpreter, we will load the kiwi module and run the creds_all command to gain all the possible credentials. Passwords, hashes from the compromised machine. We can see that we can enumerate the NTLM hashes and some clear text passwords with the help of the kiwi module. <o:p load kiwi<o:pcreds_all<o:phttps://1.bp.blogspot.com/-sp64sLERL_g/YQQ25KJBOPI/AAAAAAAAyDQ/y1s2637m3oYe4B5YbtgabFM7Wb0Y2pemQCLcBGAsYHQ/s16000/4.png Let’s run the creds command again to see if the recently enumerated creds are populated inside the table. We can observe that we have the clear text password and the NTLM hashes added into the creds table. We can see that the host that we extracted the NTLM hash is the Windows Machine running with the IP Address of 192.168.1.21 and the FTP service was running on the machine with the IP Address 1922.168.1.40<o:p https://1.bp.blogspot.com/-wiNmwrwiivc/YQQ29cfhVNI/AAAAAAAAyDU/r5OjjiwgxUoGOidGIgMz-p2G1NpocrapwCLcBGAsYHQ/s16000/7.png Extracting Creds: Telnet<o:pMoving on from the FTP service and the NTLM hashes, it’s time to extract some telnet credentials with the help of another Metasploit auxiliary called capture/telnet. We are targeting the machine with the IP Address of 192.168.1.3 and we can see that the captured credentials are ignited/123. As always running the creds command can confirm that the creds table is successfully populated with the Telnet credentials.<o:p use auxiliary/server/capture/telnet<o:pset srvhost 192.168.1.9<o:pexploit<o:pcreds<o:phttps://1.bp.blogspot.com/-t_V3ibhnItk/YQQ3CVpo0II/AAAAAAAAyDc/Z4oJ3OmGNdcpDYQBhdaFEvIjxbwQOZN9gCLcBGAsYHQ/s16000/8.png Extracting Creds: SMB<o:pNext, we will be targeting the Windows Machine with the SMB capture and generate the response to capture the NTLM hashes. We will be using the auxiliary/server/capture/smb and auxiliary/spoof/nbns/nbns_response exploits to get the NTLM hashes. We provided the host for serving the capture and the path to the john password file to be saved. Also, we provided the spoof IP Address and we have the NTLM hashes as shown in the image below.<o:p use auxiliary/server/capture/smb<o:pset srvhost 192.168.1.9<o:pset johnpwfile /root/Desktop<o:pexploit<o:puse auxiliary/spoof/nbns/nbns_response<o:pset spoofip 192.168.1.9<o:pset interface eth0<o:pexploit<o:phttps://1.bp.blogspot.com/-T_kQJShityk/YQQ3Hk7QJzI/AAAAAAAAyDg/YWgyJZbCSmw1g4O6fExb7Kf0gy87DvvXQCLcBGAsYHQ/s16000/9.png Since we were successful in capturing the NTLM hashes from the target machine, these will automatically populate the creds table. We can check these entries by running the creds command as shown in the image below.<o:p https://1.bp.blogspot.com/-4Y1oiWLa6Do/YQQ3QQv5djI/AAAAAAAAyDo/oplgS_wdwdQkkpNJSu9tX2R6tH_L-FSbwCLcBGAsYHQ/s16000/10.png Extracting Creds: Hashdump<o:pMoving on from NTLM hashes on Windows to Hashes on Linux machines. To enumerate the hashes, we will be using the Hashdump post-exploitation module on Metasploit. After exploiting a Linux Machine, we can use this post-exploitation module to gather all the hashes of the users on the compromised machine. We can see from the image below that the extracted hashes have been added to the creds table.<o:p use post/linux/gather/hashdump<o:pset session 3<o:pexploit<o:phttps://1.bp.blogspot.com/-2d029Nv37bQ/YQQ3XSp4NmI/AAAAAAAAyD0/bI7gEQEvhRULI2pNKXVt-ibjfGZJGOcyACLcBGAsYHQ/s16000/11.png It is not always necessary to run the post-exploitation module as demo[...]

5 views17:53

Hacking Articles Tips Tricks Videos Tutorials

jY1z57lVap6tza30g62gjwuQCLcBGAsYHQ/s16000/3.png Extracting Creds: Mimikatz<o:pWe are not going to use the Mimikatz directly on our target but we will be using the Meterpreter external extension called kiwi. To use Mimikatz, we will be initially compromising…

nstrated above. Meterpreter has the command that we can directly from the meterpreter shell called hashdump. It lists all the extracted hashes as shown in the image. <o:p hashdump<o:phttps://1.bp.blogspot.com/-PnSGyNILDgY/YQQ3byMI4zI/AAAAAAAAyD4/mtZjfF727SEpU01dIIkcydra7y3CNJ12QCLcBGAsYHQ/s16000/12.png When we go back to the Creds database we can see that it will have the hashes recovered from the hashdump post-exploitation module and the hashdump meterpreter command that we just ran. https://1.bp.blogspot.com/-9tC0Fvc_X0U/YQQ3ukqKQhI/AAAAAAAAyEQ/J-gDicvopIMIwrpYskmK9euVp-tL8TwtACLcBGAsYHQ/s16000/13.png Extracting Creds: SSO<o:pNext, we will be targeting the Domain Controlled Windows System and try to capture the SSO credentials programmed on it. We will use the post-exploitation module windows/gather/credentials/sso. We can see from the image below that the SSO password for Nisha User was extracted successfully.<o:p use post/windows/gather/credentials/sso<o:pset session 1<o:pexploit<o:phttps://1.bp.blogspot.com/-W2Srzq13ElA/YQQ3iXPtziI/AAAAAAAAyEE/oMS5E_R4Q84kdT17ho6nRuvfPHIkjtSWACLcBGAsYHQ/s16000/14.png Let’s check if the SSO credentials for Nisha users that we just extracted make their way into the Creds database. After running the creds command we can see that it contains the SSO credentials as well.<o:p https://1.bp.blogspot.com/-y1DzqQmztmk/YQQ324SZuyI/AAAAAAAAyEY/Wudh_-ZKhysCLMFdeVcs_Xzz3hvTU042QCLcBGAsYHQ/s16000/15.png Search Filter: Username<o:pWhile working with multiple targets across a dense network of machines, it becomes difficult to identify and search for a particular set of credentials. Creds have the option to sort the data according to your requirement. Starting with the basic filter of username. Identifying a set of credentials with the username is such a standard as lock and key. With the help of the -u option we can sort the creds table with a particular username. In the demonstration below we are searching for the credentials with the username raj. <o:p creds -u raj<o:phttps://1.bp.blogspot.com/-aZ6CfS1BI08/YQQ37Ox2KRI/AAAAAAAAyEc/-8LlR28TuD0vxdvp3VDuXAN-oD7puwu8gCLcBGAsYHQ/s16000/16.png Search Filter: Type<o:pThe next search filter that we are going to explore is the searching by the type of credentials. To understand this, we need to understand the categorization that is employed by the creds to sort different types of credentials. When we enumerated the NTLM hashes it categorized itself as the NTLM type credentials. Hence, when we use the -t option with NTLM we can get all the captured hashes as shown in the image below.<o:p creds -t ntlm<o:phttps://1.bp.blogspot.com/-Ca0ADdIB2Jw/YQQ3_QTc-TI/AAAAAAAAyEk/qauFpyGv7LsLXH1_RfiWF2OT7P4HGG2agCLcBGAsYHQ/s16000/17.png Search Filter: Port<o:pMoving on from the type of credentials to the port from which the credential is extracted. We know that we can extract the credentials from a particular service. This service must be running on a specific port. To use that port number to sort through the creds table we can use the option -p followed by the port number that you want to use for searching for credentials. In the demonstration below, we are searching for credentials that are extracted from port 23.<o:p creds -p 23<o:phttps://1.bp.blogspot.com/-BO4LEJkrmlw/YQQ4ERQDIyI/AAAAAAAAyEo/lM531Xtqf-8dY0ustytJx9OO9onQegwkQCLcBGAsYHQ/s16000/18.png Search Filter: Host<o:pThe next search filter that we are going to explore is the searching by the host of credentials. These are hosts from which the credentials originated or the hosts from which the credentials are extracted. When used the -O option with the IP Address of the hosts, it will list all the credentials that were extracted from that particular host as shown in the image below.<o:p creds -O 192.168.1.136<o:phttps://1.bp.blogspot.com/-zR8Y1qUpr7w/YQQ4PLhEi[...]

4 views17:53

Hacking Articles Tips Tricks Videos Tutorials

nstrated above. Meterpreter has the command that we can directly from the meterpreter shell called hashdump. It lists all the extracted hashes as shown in the image. <o:p hashdump<o:phttps://1.bp.blogspot.com/-PnSGyNILDgY/YQQ3byMI4zI/AAAAAAAAyD4/mtZjfF727…

RI/AAAAAAAAyE8/SR3TSMt1iK0kYy8HAk1VC-m3-RQz0RCXACLcBGAsYHQ/s16000/19.png Search Filter: Service<o:pAfter sorting from various hosts, ports, types, and usernames at last we come to the filter where we can sort the credentials by service that they were extracted from. This is similar to the one that we did with the port. But as we know that it is not always necessary that the services are running on their default ports. Hence, targeting via the Service name is an optimal strategy.<o:p creds -s ftp<o:phttps://1.bp.blogspot.com/-_T05e9hD_9E/YQQ4T9b66SI/AAAAAAAAyFA/hRydbXnsFjw0NjWnubh4WCRpYVqo5SohgCLcBGAsYHQ/s16000/20.png Adding Credentials<o:pWe introduced some odd three-four methods to add the credentials into the creds table. But even if those are not sufficient and you want particular credentials in your database. You have the choice to add it manually. It requires the user tag and the password tag. In the demonstration below, we are adding the credentials for the user Pavan. <o:p https://1.bp.blogspot.com/-7J9klcKHc2Q/YQQ4YVBacpI/AAAAAAAAyFI/cm8B4ww63ZcKKgHPrsd75A5jOMMuVC9wgCLcBGAsYHQ/s16000/21.png Exporting Credentials<o:pAs we discussed in the previous article about the hosts and workspace, we exported the contents of their database into a CSV file for reporting and other purposes. The Creds command is not untouched by this functionality. If you want to export the data from the Creds database into a CSV file, you can do so by using the -o option followed by the file name as shown below.<o:p creds -o raj.csv<o:phttps://1.bp.blogspot.com/-CBcONyzv6xg/YQQ4dLhxUwI/AAAAAAAAyFQ/mvFaqev2RRQwlby9XMnoK_FAeth4fIxywCLcBGAsYHQ/s16000/22.png Conclusion<o:pThis was a learning experience as when we start with the Penetration Activities, we tend not to focus on the documentation process or providing you work a proper structure and backup. But with time and some incidents where lack of these qualities proves to be valuable. The Creds database functionality of Metasploit is not a new feature, it has been on for years and yet the general usage of these in real life seems very less. Hence, it inspired us to provide the guide, so that lots of Penetration Testers can use it and benefit from it.<o:p

6 views17:53

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Anyone looking to make some cash?

Set your own rate just need a consultation

submitted by /u/ArentyouObama
[link] [comments]

Anyone looking to make some cash?

Set your own rate just need a consultation

6 views18:30

Hacking Articles Tips Tricks Videos Tutorials

7 views18:43

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Metasploit for Pentester: Windows Hidden Bind Shell

In this article, we are going to cover the tactics of Hidden BIND TCP shellcode. Every organization has multiple scanning tools to scan their network and to identify the new or unidentified open ports. In this type of environment, it’s very difficult to hide the suspicious bind shellcode and remains

The post Metasploit for Pentester: Windows Hidden Bind Shell appeared first on Hacking Articles.

7 views18:43

Hacking Articles Tips Tricks Videos Tutorials

6 views18:43

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Metasploit for Pentester: Creds

This is in continuation with the Metasploit for Pentester series of articles that we are presenting. More specifically we learned about the Workspaces and the Metasploit Database service in this article: Metasploit for Pentester: Database & Workspace. In this article, we will be discussing another database inside the Workspace that

The post Metasploit for Pentester: Creds appeared first on Hacking Articles.

7 views18:43

Hacking Articles Tips Tricks Videos Tutorials

Bug Bounty Stories #1: Tale of CSP bypass in an electron app!
https://securitygoat.medium.com/bug-bounty-stories-1-tale-of-csp-bypass-in-an-electron-app-f669f6ecefc9?source=rss------bug_bounty-5

7 views19:27

About

Blog

Apps

Platform