that is to be used to save Kaneki from Jason. Clicking on it leads to another page. <o:p Task 2: Where am i?<o:pQ. 1. Use nmap to scan all ports <o:pNo answer needed<o:pQ. 2. How many ports are open? <o:p3<o:pQ. 3. What is the OS used?<o:pUbuntu<o:p<o:phttp://10.10.43.18/<o:phttps://1.bp.blogspot.com/-f79yz_lzeII/YHF4hevyOVI/AAAAAAAAvT4/7jLdRteIw-AX7B90USpvQkLRaPyLfIPIgCLcBGAsYHQ/s16000/2.png <v:shape<v:imagedata<o:p

This page is called jasonroom.html. It contained a gif of Jason injecting Kaneki of some fluid. Tried to find some link or anything other than the gif on the page but we were unsuccessful. Inspecting the gif also resulted into a dead end. This is where it hit me to check the source code of the webpage. <o:p Task 3: Planning to escape<o:pQ. 1. Did you find the note that the others ghouls gave you? where did you find it? <o:p

jasonroom.html<o:p http://10.10.43.18/jasonroom.html<o:p<o:p https://1.bp.blogspot.com/-huw1OUasMF0/YHF4mDPyf7I/AAAAAAAAvT8/EGbmcQ43D2w5QpodQAHzdUbFccIsPY-_wCLcBGAsYHQ/s16000/3.png <v:shape<v:imagedata<o:p

There is a comment on the webpage. It tells us that there is a way to escape Jason. Notes further tells us that there is a mask which makes us look Anonymousand it tells us to go to the FTP room. That is a lame hint. We already know that anonymous login is enabled on the FTP. Time to enumerate the FTP.<o:p view-source:http://10.10.43.18/jasonroom.html<o:phttps://1.bp.blogspot.com/-nhG6-lK9CEI/YHF4rkiDXCI/AAAAAAAAvUE/dSUFh8dCT7Q4i_GTRrjrvZisD4D38t8ugCLcBGAsYHQ/s16000/4.png <v:shape<v:imagedata<o:p

Logging in on the FTP service we have the need_Help? Directory. It contained a text file (Aogiri_tree.txt) and another directory (Talk_with_me). We download the text file to our local system for a closer look and then we traversed into the Talk_with_me directory. It contained an executable binary need_to_talk and an image rize_and_kaneki.jpg. We download both of them to our local machine for further inspection.<o:p ftp 10.10.43.18<o:panonymous<o:pls<o:pcd need_Help?<o:pls<o:pget Aogiri_tree.txt<o:pcd Talk_with_me<o:pls<o:pget need_to_talk<o:p get rize_and_kaneki.jpg<o:phttps://1.bp.blogspot.com/--gf7SBGyhjU/YHF4xCk9p0I/AAAAAAAAvUM/XwqSOdtblkc17DubVRhfghk6_GGtomSsACLcBGAsYHQ/s16000/5.png <v:shape<v:imagedata<o:p

We read the Aogiri_tree.txt file. This seemed a message to Kaneki describing that Rize is now a part of Kaneki and Kaneki has her Kagune. It asks Kaneki to get control of his body and it also tells Kaneki that he is a part of Aogiri tree. Now we add two other words to our original notes. Kagune and Aogiri. <o:p cat Aogiri_tree.txt<o:phttps://1.bp.blogspot.com/-nOPta4bfgng/YHF43Cmq3NI/AAAAAAAAvUU/RkYtD__hiCg_z5u4mLicrLgD7WuWf2r7ACLcBGAsYHQ/s16000/6.png <v:shape<v:imagedata<o:p

Another file that we downloaded from the FTP server is image of Rize and Kaneki. We looked it in the Image Viewer and checked it details using Exif tool. No important information recovered. This made us realize that it is possible that is a compressed file. That means we need to use steghide to extract it. We tired ant told us that there is a password that needs to be entered in order to extract files inside the rize_and_kaneki.jpg.<o:p https://1.bp.blogspot.com/-uVIGCGetlMU/YHF4702giAI/AAAAAAAAvUc/DcLjYxUEalUfwmu8jEW5eJeXcrvmJIU6QCLcBGAsYHQ/s16000/7.png <v:shape<v:imagedata<o:p

Now we need to enumerate for the password. We upgraded the permissions of the need_to_talk executable to run it on our local machine. It tells us that it will give us the kagune which we can only assume is the password for extracting files from image. But in order to co[...]

ugh up the password, it requires us to enter a keyword. Puzzle inside a puzzle. Nice! We entered password. Of course, it is not the correct keyword but it gave us a hint. It asks us to take a look inside the executable. There are bunch of tools to take a look inside the executable such as rabin2 which it hints us to use, or we can use ltrace to, but simplest of all is the strings. Let’s test strings first.<o:p chmod 777 need_to_talk <o:p./need_to_talk <o:phttps://1.bp.blogspot.com/-csBrFim5Hu0/YHF5CJ1aKuI/AAAAAAAAvUk/9IKYmvcYRP4FgNtebFyczR03DR8_hCq2wCLcBGAsYHQ/s16000/8.png <v:shape<v:imagedata<o:p

Strings command extracts the human readable words from the machine code. Now, as the executable asks for a particular keyword. It is possible that it might be running a string compare to the word and the word might exist inside the binary code. We see that Kamishiro exists inside the code. It was one of the words of interest that we are extracting from the beginning of the walkthrough too. <o:p strings need_to_talk<o:phttps://1.bp.blogspot.com/-TgiWzgi9TuU/YHF5HAmrLJI/AAAAAAAAvUo/7R4Pj-KHw1MEJsLDgUtks3xKTTDdBpu9QCLcBGAsYHQ/s16000/9.png <v:shape<v:imagedata<o:p Q. 2. What is the key for Rize executable?<o:pkamishiro<o:pQ. 3. Use a tool to get the other note from Rize.<o:pNo answer needed<o:pWe run the executable again. This time when asked for keyword, we typed in Kamishiro. It tells us that we came for “You_found_1t”. Really! It seems like author is not even trying to name files properly. Still, this seems like a troll and also a password that might extract data from the image. <o:p ./need_to_talk<o:phttps://1.bp.blogspot.com/-tSxw8rf1x5k/YHF5L0t4a2I/AAAAAAAAvUw/6zrqVDcz_AA8SWgKZ6skHAprdrmWGA4zQCLcBGAsYHQ/s16000/10.png <v:shape<v:imagedata<o:p

As we entered the You_found_1t while extracting the contents from the rize_and_kankeki.jpg. It extracts a text file "yougotme.txt". Wow! such a talent naming files. Time to read the yougotme.txt. It mocks us for our smartness but then proceeds to give the most easily recognizable encoding language in the world. Morse Code. It hints that if we decode the Morse, we can get a directory. <o:p steghide extract -sf rize_and_kaneki.jpg <o:pcat yougotme.txt <o:phttps://1.bp.blogspot.com/-mEln0Ppy5no/YHF5QIIgmVI/AAAAAAAAvU0/pWfn08SLKLU18IReQLdUKfO0_U2sorOkACLcBGAsYHQ/s16000/11.png <v:shape<v:imagedata<o:p

We searched for a Morse Code decoder online. Because we are not dense enough to resort to converting each dot and dashes. Any how it gets converted into a weird string. This string however looks too familiar.<o:p https://1.bp.blogspot.com/-MH3MHwEP5F4/YHF5U-otMBI/AAAAAAAAvU8/cE-e80H16gAeCGwquqGn6SRdBvuQPj8qgCLcBGAsYHQ/s16000/12.png <v:shape<v:imagedata<o:p

We went on the asciitohex website and entered the string in the Hexadecimal section. It gets converted into another string. The == tells us this is Base64.<o:p

<v:shape<v:imagedata<o:p

<o:p https://1.bp.blogspot.com/-DqO46ZtYzgA/YHF5Zc_Th7I/AAAAAAAAvVA/mlZUhGxdWogFbJHWVLnGih7o_2OXJgEPwCLcBGAsYHQ/s16000/13.png Copying the sting and pasting inside the Base64 section we get ourselves the secret directory convincedly named d1r3c70ry_center.<o:p Task 4: What Rize is trying to say?<o:pQ. 1. What the message mean did you understand it? what it says?<o:pd1r3c70ry_center<o:pQ. 2. Can you see the weakness in the dark? no? just search <o:pNo answer needed<o:pQ. 3. What did you find something? crack it<o:pNo answer needed<o:phttps://1.bp.blogspot.com/-h7SrCkZmMXY/YHF5e27c7II/AAAAAAAAvVI/i9JoMsmFvYIyMrcKsic7Hz-Yjx2w2moJQCLcBGAsYHQ/s16000/14.png <v:shape<v:imagedata<o:p

We tried to browse the d1r3c70ry_center by careful[...]

ly placing it next to the IP address of the target machine. It gave us this image of a character who is asking that we scan him. We will not disappoint him. There are bunch of scans that we can do here. <o:p http://10.10.43.18/d1r3c70ry_center/<o:phttps://1.bp.blogspot.com/-gN5CHgmvNfs/YHF5jPLwyGI/AAAAAAAAvVQ/fcZxoM-P05YWvuo10avfYaRvW5uZyRw7wCLcBGAsYHQ/s16000/15.png <v:shape<v:imagedata<o:p

We decided to start with a dirb scan or a Directory Bruteforce. We used the common.txt as a wordlist for our scan. This gave us a directory by the name of claim.<o:p dirb http://10.10.43.18/d1r3c70ry_center/<o:phttps://1.bp.blogspot.com/-YbTAqNcMuTo/YHF5oTGvanI/AAAAAAAAvVY/T-E6Wv5emisiC5uoBiIb5Mx7T4om6UzsACLcBGAsYHQ/s16000/16.1.png <v:shape<v:imagedata<o:p

Browsing the claim directory, we are greeted Welcome Kaneki Ken. It asks us a question if we really want the power? Are we going to accept this ghoul power? A simple yes and no question with yes and no buttons. We click on both sequentially to see what happens. <o:p <o:phttp://10.10.43.18/d1r3c70ry_center/claim/<o:phttps://1.bp.blogspot.com/-jJ9a-hLCTMs/YHF5wi4KR9I/AAAAAAAAvVg/MHaYlUyD-nIedhhCiwVlCwN6RdzcrPzqACLcBGAsYHQ/s16000/16.png <v:shape<v:imagedata<o:p

We are directed to viewing a gif. However, the gif was browsed using the view parameter. This makes us so eager to try Local File Inclusion.<o:p http://10.10.43.18/d1r3c70ry_center/claim/index.php?view=flower.gif<o:phttps://1.bp.blogspot.com/-7bL-vOCqbmQ/YHF52rRHJUI/AAAAAAAAvVk/wX9AO_mQ0QwosDbSP8DmbEVSrQR3CzRygCLcBGAsYHQ/s16000/17.png <v:shape<v:imagedata<o:p Exploitation <o:pWe think the author of the machine has anticipated that as well. It politely asks us not to do it.<o:p http://10.10.43.18/d1r3c70ry_center/claim/index.php?view=../../../../etc/passwd<o:phttps://1.bp.blogspot.com/-3tTqPUIxaMk/YHF57BdeVjI/AAAAAAAAvVs/UUg6YxbCBBAv11drr-FKu95IIZVebpaFgCLcBGAsYHQ/s16000/18.png <v:shape<v:imagedata<o:p

But we are not going to back down so easily. We tried entering just dots and then with backslashes. This is where we see that it is restricting the backslashes. So, we encoded them and tried to browse the etc/passwd file again and this time we got success. We got the username and password hash. The user we will be using would be Kamishiro.<o:p Q. 4. what is Rize username?<o:pkamishiro<o:p<o:p http://10.10.43.18/d1r3c70ry_center/claim/index.php?view=%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd<o:phttps://1.bp.blogspot.com/-zW6QFfwDAiI/YHF6CyvpPgI/AAAAAAAAvV0/6nX3LtWuzxE-pYDkN1nFjLS1eKBZzu8VACLcBGAsYHQ/s16000/19.png <v:shape<v:imagedata<o:p

We copied the hash and pasted it into a file name hash. I think the author has rubbed us off that lazy file naming characteristic. Anyways, we tried to crack the hash using John the Ripper. The wordlist we decided to use was rockyou.txt. The password cracked in mere seconds and came out to be password123. This is where I felt the most trolled by the author of the machine. <o:p Q. 5. what is Rize password?<o:ppassword123<o:pnano hash<o:pjohn --wordlist=/usr/share/wordlists/rockyou.txt hash<o:phttps://1.bp.blogspot.com/-sLreGn2JBFw/YHF6IM9wHQI/AAAAAAAAvV4/7b7o3Ait4EkhaARvp8awhdfvRZALMborACLcBGAsYHQ/s16000/20.png <v:shape<v:imagedata<o:p

Time to connect to the target machine as Kamishiro user. Lucky for us there were not any new rabbit holes and we got the first flag on the machine i.e., User Flag. <o:p Task 5: Fight Jason<o:pQ. 1. user.txt<o:p###############################<o:pssh kamishiro@10.10.43.18<o:pls<o:pcat user.txt <o:p<o:p https://1.bp.blogspot.com/-MxN8NZrXxa4/YHF6QatEgmI/AAAAAAAAvWA/BEbOQOM3sscvwWDmOaFQq9GA1X1EFqCQQCLcBGAsYHQ/s16000[...]

/21.png <v:shape<v:imagedata<o:p Privilege Escalation<o:pWe need to enumerate the machine to find a way to elevate this shell to a root shell. We started by checking the sudo permissions for Kamishiro user. We see that we have a python script by the name of jail.py that we can run as root.<o:p sudo -l<o:phttps://1.bp.blogspot.com/-xxroiTDHOnw/YHF6U0MHwVI/AAAAAAAAvWI/2pdGzxwd8AM8RI2YZF-0Eb1762iOGOCOgCLcBGAsYHQ/s16000/22.png <v:shape<v:imagedata<o:p

During our hunt for user flag, we saw that jail.py exists in the current directory. Let’s take a look under the hood of this script to see its working. The script starts with a bunch of strings. Then it asks user for an input. But this input is then checked for keywords like 'eval', 'exec', 'import', 'open', 'os', 'read', 'system' and 'write'. This means that we are restricted to execute any reverse shell script or bash script to get root. We need to get a bit creative here. <o:p cat jail.py<o:phttps://1.bp.blogspot.com/-UlE1n3usWg8/YHF6YEaf_6I/AAAAAAAAvWM/OhCE-vQ35rgnKzujXTcqnTBp6Y_IqSz1gCLcBGAsYHQ/s16000/23.png <v:shape<v:imagedata<o:p

We needed a way to execute a command while evading the checks. Python allows us to define built-in objects as __builtins__modules. So instead of using import or os we will use __IMPORT__ and OS. We could have been at it to create a proper script and try it again and again on the script. But instead of reinventing the wheel, we decided to search for Python Jails and we got this articlewhich has created the command that works to read a file. We modified it to invoke a shell. Since it is possible to run this script as root using sudo the shell that it will generate will be of root as well. After executing the script and providing the builtins command we got the root shell. Traversing inside the root directory we found the final flag i.e., Root Flag. <o:p Q. 2. root.txt<o:p###############################<o:pTask 6: Special thanks<o:pQ. 1. Congratulations you've complete Tokyo ghoul room 1<o:pNo answer needed<o:p<o:psudo /usr/bin/python3 /home/kamishiro/jail.py<o:p__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('/bin/bash')<o:pid<o:pcd /root<o:pls<o:pcat root.txt<o:phttps://1.bp.blogspot.com/-HE6SiyB5PaE/YHF6cMNy-gI/AAAAAAAAvWQ/pUyyCr70T1UMWp06ORyPeXjcjV_nlroqgCLcBGAsYHQ/s16000/24.png <v:shape<v:imagedata<o:p

<o:p

SNOWCRASH - A Polyglot Payload Generator

SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user (in this case combined Bash and Powershell code) is embedded into a single polyglot template, which is platform-agnostic. There are few payloads available, including command execution, reverse shell establishment, binary execution and some more :>Basic usage Install dependencies: ./install.sh List available payloads: ./snowcrash --list Generate chosen payload: ./snowcrash --payload memexec --out polyglot_script Change extension of the polyglot script: mv polyglot_script polyglot_script.ps1 Execute polyglot script on the target machine Additional notes Delay before script run and payload execution can be specified as an interval (using --sleep flag) in the form: xs|m|h where x = Amount of interval to spend in idle states = Secondsm = Sinutesh = Hours After generation, the extension of generated script containing the payload can be set either to .sh or .ps1 (depending on the platform we want to target). Generated payload can be written directly to STDOUT (instead of writing to a file) using --stdout flag. Screenshots Download SNOWCRASH
Read more...

Hacking on Medium
HackTheBox: Magic Write-Up

https://cdn-images-1.medium.com/max/600/1*s_UYo9Rc7qTeVFHf5lM0CQ.png
Magic is a medium-rated Linux machine on the reputable penetration testing platform known as HackTheBox. The ultimate goal is to…

Continue reading on Medium »

Hacking on Medium
Easy Way to Find a Genuine Hacker For Hire Online

https://cdn-images-1.medium.com/max/626/1*y38JVN-kVnzWutwYvkUwVA.jpeg
If you want to choose a genuine hacker for hire, make sure that you do enough research.

Continue reading on Medium »

SNOWCRASH - A Polyglot Payload Generator
http://www.kitploit.com/2021/04/snowcrash-polyglot-payload-generator.html

SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload (https://www.kitploit.com/search/label/Payload) selected by the user (in this case combined Bash and Powershell code) is embedded (https://www.kitploit.com/search/label/Embedded) into a single polyglot template, which is platform-agnostic. There are few payloads available, including command execution, reverse shell establishment, binary execution and some more :>
Basic usage
Install dependencies: ./install.sh List available payloads: ./snowcrash --list Generate chosen payload: ./snowcrash --payload memexec --out polyglot_script Change extension of the polyglot script: mv polyglot_script polyglot_script.ps1 Execute polyglot script on the target machine
Additional notes
Delay before script run and payload execution can be specified as an interval (using --sleep flag) in the form: x[s|m|h]
where x = Amount of interval to spend in idle state
s = Seconds
m = Sinutes
h = Hours
After generation, the extension of generated script containing the payload can be set either to .sh or .ps1 (depending on the platform we want to target). Generated payload can be written directly to STDOUT (instead of writing to a file) using --stdout flag.
Screenshots

Download SNOWCRASH (https://github.com/redcode-labs/SNOWCRASH)

KitPloit - PenTest Tools!
SNOWCRASH - A Polyglot Payload Generator

https://1.bp.blogspot.com/-4QZK_wPBE6c/YGveYpfHSUI/AAAAAAAAVz8/BbzVg74NAdECVjT_lllrjy1SdbHfsLligCNcBGAsYHQ/w640-h360/SNOWCRASH_1_snowcrash.png

SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user (in this case combined Bash and Powershell code) is embedded into a single polyglot template, which is platform-agnostic.

There are few payloads available, including command execution, reverse shell establishment, binary execution and some more :>
Basic usage

1.
Install dependencies: ./install.sh

2.
List available payloads: ./snowcrash --list

3.
Generate chosen payload: ./snowcrash --payload memexec --out polyglot_script

4.
Change extension of the polyglot script: mv polyglot_script polyglot_script.ps1

5.
Execute polyglot script on the target machine
Additional notes

Delay before script run and payload execution can be specified as an interval (using --sleepflag) in the form:
x[s|m|h]

where
x = Amount of interval to spend in idle state
s = Seconds
m = Sinutes
h = Hours

After generation, the extension of generated script containing the payload can be set either to .shor .ps1(depending on the platform we want to target).

Generated payload can be written directly to STDOUT (instead of writing to a file) using --stdoutflag.

Screenshots
https://1.bp.blogspot.com/-WX2kf_rZw2g/YGveohMkEvI/AAAAAAAAV0Q/U3qQhHvzN1MHNr46BVW8dOr7ehWfMMF-QCNcBGAsYHQ/w640-h360/SNOWCRASH_4_screenshot1.png
https://1.bp.blogspot.com/-AQNyxW8I-7Q/YGveootO4EI/AAAAAAAAV0M/kLiOIbLVXsEbnL5RGnGbE90nMLtTssS4ACNcBGAsYHQ/w640-h360/SNOWCRASH_5_screenshot2.png
Download SNOWCRASH

Recon Methodology for Bug Hunting !

What is Reconnaissance or information gathering?Continue reading on Medium »
Read more...

hacking: security in practice
Crack executables with gdb?

Hi, I'm a beginner in hacking and I have some Linux executables(Elf) from which I have to extract some data, the first one use several system sleeps and very long loops to avoid this data print, the data Is generated procedurally so I cannot just search, find and decode It in the binaries, so my first question Is, Is It possible to use gdb to skip sleeps and loops and how can I do It? The second executable gets an input and does some operations on It, when I try to reach the part of code that I'd like to execute I get segmentation fault error, It seems that the code was written to have this error on purpose. Reading the assembly code I found that segmentation fault is generated on some variables copy in or from DWORD PTR and BYTE PTR, I've also noticed that most of the times the pointers point to nothing(0x000...), In this case what should I do to get over this error and execute the code I want? Note that I don't have debug symbols and source codes, just the elfs, both doesn't have canaries + I have installed gef to have some additional help.

submitted by /u/TurdPedo
[link] [comments]

Recon Methodology for Bug Hunting !
https://xcheater.medium.com/recon-methodology-for-bug-hunting-e623120a7ca6?source=rss------bug_bounty-5

What is Reconnaissance or information gathering?Continue reading on Medium » (https://xcheater.medium.com/recon-methodology-for-bug-hunting-e623120a7ca6?source=rss------bug_bounty-5)