Hacking Articles Tips Tricks Videos Tutorials
470 subscribers
66K photos
15 videos
157 files
132K links
Exploit
Pentesting
Hacking
Red Team
Blue Team
Kali Linux
Bug Bounty
Black Hat
Cyber security etc

@Hacking_Video
@Hacking_attack
Download Telegram
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Hackable: 3 VulnHub Walkthrough

Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in the way that it was designed. Also, if you haven’t checked the machine or are having problems, you can attempt every approach you know. The key is port knocking, so let’s get started and discover how to split things down into digestible chunks. Pentesting MethodologyNetwork Scanning

* netdiscover
* nmap

Enumeration

* abusing http
* dirb
* wordlist
* port knocking

Exploitation

* hydra
* ssh
* user flag
* linpeas

Privilege Escalation

* lxd
* root flag

Level: Medium Network ScanningTo begin with, we must use the netdiscover command to scan the network for the IP address of the victim machine.
netdiscover
Our IP address is 192.168.1.185.

https://blogger.googleusercontent.com/img/a/AVvXsEhVERM4UlvgrikfFqiOYmQ2Z8vmPZ-73pkMQCBy9i1-QOZTAtw7kcVLbzG5x-EFkjAVrvUb1NmlpxbATDh4a4c8yWXs3IbJemu2bA8mpCQa7h_X6nv3BPNBPaRsjUGvPtnmMckC9_POPfDnnloZ_yv4mJBvz8h6h9ygCWb5nXGYXzwqpT0UsPq_UgEpgw=s16000

To move forward in this process, we are launching Nmap. For open port enumeration.
nmap -sC -sV 192.168.1.185
According to Nmap, we have an SSH server operating on port 22 and an HTTP service (Apache Server) running on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEh7BOL_YWDJOF051U9Nug9s-L59Ic1QK5YcjB5iX7Qkytt9ykvj8rVYILq7c9UZjI1XK30nxoXvkamcNP0ZvCLZQwq-hOhmgeexZAW94nN8dUzVO4HmtxC3Itqo7savKGUpNrAlxMkm3x6bNKL9vuNMaUYd5KmKtSyUNnCkiy7WdOeoQ2PGE8NxBYFLUw=s16000 EnumerationFirst, we’ll attempt to use HTTP. Let’s look at port 80 and see if anything interesting comes up. We can immediately verify it in the browser because the Apache Server is listening on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEi211wSF6iWL58biBopenZC8-0IZEaqXGblPKo7gtWQ3y77D2KwmCuCwLrxh8AiYkz7ZhSndIjgJL7JCABakYKKUUuHMK_4kx4s0xCy5_IlIBQ8FbCaw2j0m0s4RGdJw3gWz27scHQF4HFhYJyZ4--W_J4AWuN_SQo5P3uRSL_cTjnglO7OgPz-EDmH3g=s16000 w

Nothing in-trusting on the main page. As a result, we examined its source code and discovered some information that will be valuable in this lab.

* We received a link to the login page.
* We chose the username “jubiscleudo.”
* We have gotten a hint that this lab requires port knocking.

https://blogger.googleusercontent.com/img/a/AVvXsEg5dzsOwH__RbupQ-l5c033EKAS_KlSorzXpRQYECF8Eu_baDuetC0dNVN8i-FkHx5Njequkd9FpqRTWARIhskPJ1ECZnUhTNVepG5p4F5jVZ_HVMkFEp69kUsQ5xn1LKuETe12MLy_Upb07rw-TNhmosHSMiRzofKOMYwUDLtNfqnJZ6sy5iXcKDy9hQ=s16000

To find out more about this laboratory. To uncover certain hidden directory paths, we execute a dirb directory scan.
dirb http://192.168.1.185/
Let’s look through a lot of trustworthy directories, so let’s look through them one by one.

https://blogger.googleusercontent.com/img/a/AVvXsEgfDEzIaFgeGbBYlMfZKye_YNErmR_EsGKAvrjNgteQhZ9HkfxjfiSXnVzgalmE_LAiL2uyjoFbe0-LT_LItng9DnHSkeQVOn1lwKCDWGgsxuKkX6w7wn6gruokYREDdlOvxrnxYaDI8oPsiTTOC8MFvKD7CqxYLSOBJE5O__vTPYSlH9WzHAW6deRoIw=s16000

So, let’s have a look at the first result backup directory. We obtained a word list file that might be valuable in the future.

https://blogger.googleusercontent.com/img/a/AVvXsEgVZr5GcfS-MY8iGAWRKBjXMCkjJdzsUlOly6xYQVwsnGlnpNzxr3H9qbNucRp0TnrcH24edDpHN8MnRD4rDGx0TekOqe6SvCvcEt8HFO_L73m-3Hlrfsirm6mGHgodJMq6kdbquTCas_3HX6ylII__nhO3j8i6h_ZJCTIqSpZRMMfPrlPCXWDggT5tIg=s16000

As a result, we run the wget command to download this word list to our machine.
wget http://192.168.1.185/backup/wordlist.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhLZM499xBUbcE72tbHdXo13bTYS-wE5Zd0gsAIK-8ZCfiIBS26gyQHinfoNxv2h_HKXd7ILA1j9OehSYdyCZKy8SqfsdLEpOkZ7tMbAyKwy8mTma2zPNnuno-ljdlS1YMvUm7Tdags5PAenN-FQOY2GRY4oM4HOaA[...]

___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Hackable: 3 VulnHub Walkthrough Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in…
BmZ5gJq-ougO2PyJ7CnlvZhVtag=s16000

Let’s look at the second config directory; we found a file called 1.txt. We ran this file through the browser and discovered some essential but mysterious context.

https://blogger.googleusercontent.com/img/a/AVvXsEj0utZBhOMYO_pXGcaN-_Vjvj3r_qrsqim8JJz4ILThIQFglyv1lCG475WzxQlLN4EAyeuwnuzy4PjQLN63TC4OGcsMOysI8BHLwuB6bIWzvqgoBQuVeiwcRNEUtFYtk3mgkNyx9s-9kNV4BscJQWd6Czins-VsDu7D5T96r8XVKfDFQn-OyR7WGr9xww=s16000

As a result, we attempt to decode this text using the following command.We received our first text of port knocking after recovering the initial text (10000).
echo MTAwMDA= | base64 -d
https://blogger.googleusercontent.com/img/a/AVvXsEgonhSm44bJZc5fmvbpi7g0RqmAaT9UjwllWkObLO-EALHuV89yRKLUcvcQLbsYJa-HBFm4Lj2nAVgj17ibVlY3gh4gbNn5nSWhr8UxDsF9DI346MFJTiTqJBFRri4noWeSblQlQ_D5oPb6vWtTwTLYZHPvChQz-Ci0HDMIBSS5wcLP5W2qmoiLx-Z8cg=s16000

When we checked the third one (CSS directory), we got another text file called 2.txt. where we obtained an enumeration of brain fucks.

https://blogger.googleusercontent.com/img/a/AVvXsEjmFUIY0qp3UIHI8_LU04ORswWN8T1iEFPQAIW0rzjh6K3o5F2DCXwOgZoKIuDP2-51BLV5rCpfR8ygyZpRd_My1sbZPOkfMfb3NBrhjM7BM356R_OqcG9cuzrh8us3BLR2B1i6cnn9OzfU9dolL1U367em0opfsMyKROCPxY8wi4skQJneo9eXpzQLIA=s16000

So, we checked the brain fuck decoder online and recovered the second context (4444) of port knocking activity by providing them with our text.

https://blogger.googleusercontent.com/img/a/AVvXsEg53JmRn9-a9LhwhtHVjUYE16CsWxDXW3rohNyCX4luBpoSykts6FCjdKqHlAACkDDu5twYYiD8a7OyR4kd3e72Vbdns8xRsBIgmUenLSQq4O52vVr1yc0Nqnlb6nUCKrQPlX-ZxfgoSu8fNvPDO2peI-ay-xbuohs6cFf__SUkSE9PX95QBFX13LxWLA=s16000

Now we have two port knocking contexts: 10000 and 4444. Remember that we obtained a link to a login page earlier? We immediately checked that URL but found nothing interesting. So, we looked at the source code. We found an image called 3.jpg that might provide some insight into the problem.

https://blogger.googleusercontent.com/img/a/AVvXsEjUQ73dkIia9EO5R77nxiP9mRfgL9NYzYd0tXdcBhfhKS9YVkE-Ok9TaQ-YHSzkv8YbUiaRQcyBtprc2wAFFnP8fkHAsfuuErceIodB3hMEQlMRIxaaIygncjm4K57foKqH8D0WwIbui1qkT_nqniu6rhcUEnA8WylMzPUzsBEw_G_EvqviuKwvVYb8DQ=s16000
We looked at that image, but there was nothing unusual about it. We’ll have to think beyond the box.

https://blogger.googleusercontent.com/img/a/AVvXsEju1fwyTWbGTIQo_nmuPKXadl8_ZvhYbE4FaOVTxAz5CIj_FDRtQw7KlueubQcAKGPlBEuu8DBKzGLKO7VWimOZZM-I3XzuVz4nA7smSAk7AZlnKt3KlxEgq7XkfuSHa8DDSK0scWIzpyjzGCvatlTMxOVcT6_CgztHp1y2Ru0DO5MfNz84f01WaZzL_w=s16000

It might have something, so we considered steghide, which could be useful in certain situations. For our image file, we now provide the steghide tool. Hurray!! We received a top-secret text file.
steghide extract -sf 3.jpg
To explore this file, we use the cat command. Congratulations!! 65535 is our third context of port knocking.
cat steganopayload48505.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgaW5gIjfhX1cFYtylI_IZle-QWiOcUq0ZjjPaZfIsOfOyi1wXaD7CjMPD79HZvGjaSVQrAq8umJDyyFyaGjWnDt0cdEfB3B4QrUWMBkMvnNiHKndrEvm7WkjY_LxKmpumvoNWQRbg0GVBwjCYVhqtL7o5fPk07bjfFR_RM3CgOZExn9VdKUNGEL7-DVw=s16000

We’re now ready to perform port knocking. We’re good to go if we use this command in conjunction with our context.
knock 192.168.1.185 10000 4444 65535
We run a nmap scan after port knocking to see what results we get. As you can see, the ssh port has been opened.
nmap -sV 192.168.1.185
https://blogger.googleusercontent.com/img/a/AVvXsEj4XJ8il2EhcF72wFhFketOyAtyYJDbwGmqFUyR-5wPOH3b4qu2f7W0XDWYvm_cKHxElmiz2qXLtLiUaj1eurO6B6RH7ylPby9gfRz9eAkdnshBsNjQ_XW38_i8uN_9UvjpCiEJVRH366AJVxd8P4_Z-3B3Da_sqwJ5KflFSgOxUAVbjdnS-aPfX_p0eg=s16000 ExploitationNow we’re ready to attempt exploitation using the information we gained from previous outcomes, including a user name gained from source code. Let’s try a brute force attack with the word list we stored for later.

Let’s use the hydra to[...]

___________________________
@hacking_Attack
@Hacking_Video